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to read this tutorial by scrolling through all the pages! 


Use the flowchart links and links at bottom of each section to take you directly to 
the correct instructions for your situation! 


Trying to read through each page regardless IS POINTLESS! (And confusing) 
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Introduction 


JungleFlasher is developed in conjunction with Team Jungle in an effort to bring all 360 
DVD-Drive flashing functions together in one easy to use Win32 Application. JungleFlasher 
provides several functions that up until now were carried by several different app's in both Dos 
and Win32. JungleFlasher is also fully supported in x64 environments. 

Recent revisions of JungleFlasher have added support for Xecuters X360USB Pro — For USB 
based flashing on ALL systems, with no freezing/unsigned driver issues. 


The FirmwareTool 32 tab is used to process firmware files. Jungle Flasher will parse the files, 
identify the firmware type and display relevant information such as the all-important DVD key 
and OSIG strings etc... On the Target sub-tab, MD5 hash checking of iXtreme firmware files is 
conducted to confirm authenticity. With both source and target files loaded, the relevant 
source data can be transferred to the Target (a.k.a. Spoofed), which can then be flashed to the 
target drive. 


The DVDKey32 tab is used to extract info from LiteOn — the undumpable drive. All unique 
information is extracted: DVD key, unique inquiry and identify strings and drive serial 
information. This info is stored in one easy to use file,” Dummy.bin”. This is a 256kb file that 
mimics the approximate structure of a BenQ firmware file and is automatically loaded to the 
source sub-tab in the FirmwareTool 32 Tab. Jungle Flasher v0.1.79b introduced support for Pógó 
Mo Thoin (PMT) a new method of extracting the DVDKey from all (Phat) LiteOn DVD Drives, using only a 
switch on the 3.3v line and a probe to GND at the very least, or using such devices as the Xecuter Probe 
3. 

Legacy methods are still supported under this tab, such as LO83info, DVDKey32, Dummy from iXtreme 
and rebuilding a Dummy.bin from individual files (key/inquiry/identify/serial) - Users who wish to utilise 
these methods can find information contained within the LiteOn Flow Chart of the User Guide. 


The MTKFlash 32 tab is used to unlock Beng, Samsung “Slim 9504” LiteOn drives and then 
dump the current flash for use in the source sub-tab in FirmwareTool 32 tab. You can also erase 
a LiteOn in preparation for flashing. All MTK (Mediatek) Based drives can be flashed using this 
tab. 


The Hitachi GDR3120 tab is for Hitachi drives which are flashed differently from the MTK based 
drives mentioned above, therefore have their own dedicated tab. Hitachi’s are flashed as a 
“Live” drive, on a sector by sector basis and as such needs to be performed in a very controlled 
way so the process is heavily automated. JungleFlasher will only flash iXtreme to a stock drive 
and so a restore facility is provided, which allows for a full restore to stock f/w of previously 
modded drives. Several additional features like setting Mode-B over PortlO, USmodeB and 
79Unlock are included for convenience. Dumping and flashing is also possible over PortlO for 
those who removed VIA drivers to work around Lite-On-Erase lockup issues. 


JungleFlasher is intended to be rich in information providing as much relevant and useful 
information as possible. On the DVDKey 32 and MTKFlash 32 tabs, all I/O and COM port 
information is detected and displayed, as well as drive and device properties for the currently 
selected drive. 
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Overview of JungleFlasher and its functions 


When you start JungleFlasher, you will be presented with 5 tabs; 
FirmwareTool32, DVDKey32, MTKFlash32, Hitachi GDR-3120L & IRC Channel. 


Firmware Tool 32_| DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel 


FirmwareTool32 is used to view firmware details, manipulate these firmwares, and to save the 
firmware and/or details of the firmware. 


It is split into 2 sections, Source and Target, with function buttons surrounding it. 


Source, this is the originating firmware, this can be previously dumped firmware (containing 
console specific drive key, Drive string ID and serial data), original firmware, dummy firmware 
etc. This data should always mimic what the Xbox 360 should expect from the DVD Drive. 


The Target area (buffer) should contain the firmware you wish to apply to the drive itself, this 

firmware will be manufacturer specific, BenQ firmware for BenQ drives / LiteOn firmware for 

LiteOn Drives etc. Hitachi Drives do not use FirmwareTool32 in the same manner; this is fully 
explained in Hitachi section. 


FimmwareTool 32 | DVDKey 32 | MTKAlash 32 | Hitachi GDR3120 | IRC Channel 


DVDKey32 is primarily used to obtain Key.bin, Inquiry.bin, Identify.bin, Serial.bin and 
Dummy.bin from all LiteOn PLDS drives, both Phat and Slim. It also has an option to rebuild 
from previous files (for people who used other, older applications or those who followed poor 
advice before). Slim 9504 Users can utilize Slim unlock in the MTKFlash32 Tab to read the full 
FW from the drive. 


JungleFlasher v0.1.79b introduced “PhatKey” — A method of obtaining the DVDKey from Phat 
LiteOn drives, using only a probe and a switch on the drives 3.3v line — Xecuters Probe 3 is a 
professional / affordable tool targeted at this method and comes highly recommended. 


Older legacy methods, such as DVDKey32 and LO83info remain supported for those wishing to 
use these exploits. 


Jungleflasher v0.174 brought a Key verification routine which tests the keys, primarily on Lite- 
On drives but is also applied to pre-78 Hitachi drives and Samsung drives and can be verified on 
Benq too (though not automated like Lite-on) Using this ability it’s now possible to create a 
new Dummy.bin from the key database and Verify that it is correct. 
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There are also 5 checkboxes found in this tab, USB Only, VIA Ports Only and Include non-IDE 
ports, added for extra safety and compatibility; Additional Features — for use with the CK3-CP 
and Maximus USB Xtractor Push Button to extract feature this launches the DVDKey32 
command from the Hardware Device itself. The final one being Dummy.bin Only — this being a 
cleaner method of storing files as Dummy.bin incorporates the other files obtained. 


FimwareTool 32 | DVDKey 32 | MTK Flash 32 || HitachiGDR3120 | IRC Channel 


MTKFlash32 contains a variety of functions, from unlocking and reading of BenQ, Samsung and 
Slim LiteOn drives using their dedicated Unlock buttons, or LiteOn drives after placing them in 


Vendor Mode (using MRA Hack). 


MTKFlash32 is also where you are able to send the Intro of Death (a.k.a LiteOn Erase) to the 
LiteOn PLDS DG16-D2S after obtaining DVDKey, and for writing to the drive after Intro of 
Death, or once drive placed in Vendor Mode using MRA Hack. 


MTKFlash32 will also erase and write Samsung and BenQ and LiteOn drives, once the drives 
have been unlocked/placed in vendor mode. 


MTKFlash32 will show, in the lower left section, the details of the drive inquiring on the 
respective I / O Port listed above. This is where you will identify which S-ATA Port to use for 
carrying out the process. 


FimwareTool 32 | DVDKey32 | MTKAlash32 į HitachiGDR3120 | IRC Channel 


Hitachi GDR3120 As mentioned previously, the Hitachi Drives are flashed completely differently 
to the MTK Based drives; Hitachi’s are flashed as a “Live Drive” on a sector by sector basis. 


For this reason, JungleFlasher has its own dedicated Hitachi tab, all the flashing options you 
may need to do can be done under this tab. 


As with the other Tabs, JungleFlasher will show the I/O port list for identifying what S-ATA Port 
your drive is on. 


It also incorporates a Raw Mode-B command for putting a drive into Mode-B and automates 
the Play/Pause/Eject for 79Unlock — Audio Disc still required! 


Once the drive is actually in Mode-B you can use the flashing options located in this section of 
the application, the options themselves are pretty self explanatory. 


With the Firmware Pack installed, JungleFlasher will automatically load the correct iXtreme file 
for your drive, or Original Firmware if restoring. 
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| FimwareTooi32 | DVDKey32 | MTK Fash 32 | Hitachi GDR3120 


With the release of JungleFlasher 1.71, there is now a IRC Channel tab within the actual 
program. If you have read this tutorial and still cannot figure out your problem, please feel 
free to use the chat function and get some live support with your problem. Please DO NOT 

expect us to help you if you have not even tried to research your problem! There is a huge 
amount of information in this tutorial and the vast majority of methods are covered for almost 
all situations. 


NOTE: If requesting advice/help in IRC Channel — PLEASE — give a good description of your 
setup- OS, Drive, FW, SATA chipset, Difficulty you’re experiencing etc. DO NOT - give a single 
line of info and expect people to magically know what your problem is! 


FimwareTool 32 | DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel 


PJungleF lashergnet 
lung = as ergnet oe 


i \ | TNN 


Welcome to Jungle Flasher support 


Please read the Tutorial. all the answers are in there. 
Or have a search on our forum. 


Click Connect to use Java IRC applet to connect 
to #JungleFlasher on EFNet 


-Donate — 
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BEFORE USING JUNGLEFLASHER 


You Must Have .net framework installed 


.net framework 2.0 or later for Windows XP machines 
.net framework 3.5 SP1 on Windows Vista Machines 
.net framework is built-into Windows 7 (easy life!) 


IF you get a libUSBO.dIl error 


Copy libUSBO.dIl file from its folder, into the same directory as JungleFlasher.exe 


- 


Name 
di Documentation 28/0 
ab firmware 28/0 
J libusb 
we JungleFlasher.exe 20/0 


N 

oò 

3 } 
NN N N 


| | | JungleFlasher. 


L| PortlO-Kai_Schtrom.txt 30/12/200 


You Must 
JungleFlasher Firmware Pack (vital for Hitachi Drives) 


Place all the individual .bin firmware files inside the firmware folder! 


Download the latest iXtreme firmwares from usual sources — place all the .bin files into 
the firmware folder that is inside the JungleFlasher folder! (This allows for auto-loading 
of firmware as well as being essential for operation during Hitachi 
manipulation/flashing) 


If you are using a VIA card - remove the drivers! 
It is advisable as the drivers tend to cause problems on a lot of drives but very 
noticeable with erased LiteOn, causing the infamous ‘Lite-On + VIA Freeze’ 
CLICK HERE TO FIND OUT HOW TO DO IT PROPERLY 


NOTE: 0225/0401/1071 SLIM DRIVES DON’T WORK WELL WITH VIA CHIPSET 


If using ANY Operating System other than Win XP x86 you must right- 
click on Jungleflasher Icon and select “Run as Administrator” 
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Name Date modified Type Size 


Documentation 28/02/2011 18:48 File folder 
firmware 28/02/2011 18:48 File folder 
libusb 28/02/2011 18:48 File folder 


Open 
|) libusb0.dll 
|_| PortlO-Kai_ Troubleshoot compatibility ocument 

Scan with Microsoft Security Essentials... 


ation extens... 


Share with 


Add to archive... 


OR 


Right click on icon, select properties > compatibility, tick the box, press ok 


f — 
gœ JungleFlasher.exe Properties 


[General | Compatibilty | Securty | Details | Previous Versions 


plage me ro and it worked correctly on 
i the compatibility mode that 


Help me choose the settings 
Compatibility mode 


[E] Run this program in compatibility mode for: 
[Windows XP (Service Pack 3) 4 


Run in 256 colors 

F| Run in 640 x 480 screen resolution 
Disable visual themes 

Disable desktop composition 

“| Disable display scaling on high DPI settings 


CLICK HERE FOR ADDITIONAL INSTRUCTIONS FOR USE WITH x64 VISTA/WIN 7 
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WHEN you run Jungleflasher you MUST ensure PortlOXX*.sys is RUNNING! 
(Unless using X360USB Pro) 
You can do this easily by looking at the log at the bottom of the window (as shown) 


* XX - will be either 32 (for x86 operating systems) or 64 (for x64 operating systems) 


JungleFlasher 0.1.79 Beta (210) 
Session Started Sat Mar 05 07:56:28 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 


Found 10 I/O Ports. 
Found 0 Com Ports. 
Found 9 windows drives C: D: E: F: G: H: I: J: K: 


IF YOU ARE USING X360USB Pro 


PortlO is NOT REQUIRED 
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WARNING 


Flashing Tasks 
| Intro /Device ID | | Outro/ATAReset | 


| Read | | Eese | | Wie | 


Phat © Slim <>, 


IF YOU SEE THIS BUTTON WHILST WORKING ON A 


Phat LiteOn Drive 


It is ONLY for use with Slim PCBs, Replacement 0225 
PCB’s and Pro-Kit Modified PCB’s 


DO NOT PRESS IT 
IT WILL LOCK YOUR DRIVE! 
IT IS A PAIN IN THE ASS TO UNLOCK AGAIN 


WARNING 


PROCEED 
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Which Drive do you have? 


Click on the appropriate link below. 


Original Xbox360 
Slim Xbox360 


Other Info — for troubleshooting, or the inquisitive mind 


FAQ’s Advanced User VIA Ports Only / X64 additional 
Functions Include Non-IDE instructions 
Support for earlier | Missing Serial Data Return a LiteOn to Verified Lite-On 
LiteOn dumps | Stock Key? 
Manual Spoofing Spoofing a Hitachi Spoofing a | Thanks 


different drive 


Bad Flash Recovery with PMT / Probe 3 Samsung What is Pógó Mo Thóin? 


X360USB Unlock / Recovery 


PMT / Probe 3 Bad Flash PMT / Probe 3 Bad Flash 
Recovery Slim LiteOn Recovery BenQ 
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Which Phat Drive 
Samsung CLICK HERE | Hitachi CLICK HERE 


You can check the Xbox 360 DVD drive type by removing the 
faceplate and checking the hole underneath the DVD bezel. 


White Wires = BenQ Yellow Wires = LiteOn 


For Exact model information of drive you must read the label on top of the drive case! 


You will require this information to enable you to choose the correct methods for your drive! 
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Currently several different slim drives exist: 
LiteOn DG-16D4S (FW Ver. 9504 or if updated 0272) 
The Other Drives are 
LiteOn DG-16D4S (FW Ver. 0225 ,0401, 1071) 
Drive Key can be dumped ONLY (unless unlocked) 
Hitachi (FW Ver. 0500) 


You can tell the difference between LiteOn and Hitachi by the drive tray 


\ 


Read the label on the drive as which LiteOn drive you have. 


Note: There are also some mislabelled as 9504 and are actually 0225, the only 
100% method is to connect your drive to your PC and see how it reports in 
Jungleflasher. If it reports as 0272 is has been updated by dashboard update 
13146. 


CONTINUE 
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Samsung (TS-H943) MS25 /MS28. 


Overview. 
The steps to modifying / restoring a Samsung Drive follow the basic outline of: 
e Unlocking the Drive (MS28 or Xtreme 3.3+ Firmwares) 
e Reading the Original firmware 
e Patching Key into hacked Firmware 


e Writing Drive 


The tutorial covers multiple unlock methods, which are dependent upon which drive, its current 
firmware and your SATA chipset! 


The following flowchart will help you decide which method you should use to achieve the 
unlocked state on a Samsung drive (Vendor Mode — status 0x70) in preparation for READING 
and/or WRITING to, the drive 


Now, we can proceed to modifying the drive. 


Power drive with it connected to PC via SATA then open JungleFlasher.exe. You will be 
presented with the Welcome Screen. 


After a few seconds the main window will load. 


Follow the flowchart below to obtain the correct method for your setup and drive! 
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Alternative 
Alternative option for Nforce 


option for those on me 


with PMT/Probe 3 


users. For ALL 
- failed unlock or Samsung drives 
bad-flashed 


CLICK HERE 


or Via chipset 


CLICK HERE 


Is The Firmware on drive STOCK? Is The Firmware on drive STOCK? 


a a a 


IF UNSURE — ASSUME NO! IF UNSURE — ASSUME NO! 


~----- 


Hacked Firmware! 
Which Version? 


See 


Xtreme 3.3 > iXtreme 1.5> iXtreme LT 
iXtreme 1.4 iXtreme 1.61 


CLICK HERE CLICK HERE CLICK HERE 


IF — you ASSUMED MS28 
drive did not have stock 
firmware BUT have no luck 
unlocking it, using these 
methods — try 
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Unlocking the drive. 
Before we can do anything to the drive, it must be in Vendor Mode (status 0x70). 


All Unlocking is taken place under the MTKFlash 32 tab. 


FirmwareTool 32 | DVDKey 32 [ MTK Fash 32 || Hitachi GDR3120 
Source | Inquiry | Identify | Drive Serial | User Guide 


Note: Upon selecting the correct port the drive shows up and key is dumped and verified 
against the drive! (Before doing anything to the drive) — The firmware has NOT yet been 
dumped! However if you save the log you now have a known verified key from your drive. 


E 
 JungleFlasher 0.1.79 Beta 


E l 
FimwareTool 32 | DVDKey | MTK Fash 32 | HifichiGDR3120 | IRC Channel 
A 


fe) 
activate.iso mt Q RA 
1/0 Port USB Only [E] VIA ports Only E] 360 Tools Í STON ees onk 
ooo00 ë ~ [.) Include non-IDE Ports [7] | an | ames | | T | | Sn 
À UnLock | | UnLock | | Erase UnLock 
epe Connect any 
ess: 0x0000 
oat a AA Flash Chip Properties SATA device 
Channel: Primary is ID: to any 
: Device ID: 
Postion: Master i es rc or laptop 
Device: XECUTER X360USB PRO salle 
(Ver 0.18) ae via USB 
Drive Properties pe 
Vendor: TSSTcorp Feshing Take 
“a oe ae [intro /Device ID | [ Outro ZATA Reset | 
F/W Rev: ms28 
Reserved: [__ Read | [Erase | [o Wie 
DVD Key: Verified F : 


portio32.sys Driver Installed 
portio32.sys Driver Started, thanks Schtrom™S 
X360USB PRO detected, Version 0.18 


Notice the Key is already Verified! 
Samsung drive keys are verified 
upon the drive being detected. 
Hover your mouse over the Key to 
see if the key is in your KeyDb 


Found 11 I/O Ports. 
Found 0 Com Ports. 
Found 9 windows drives C: D: E: F: G: H: I: J: K: 
Found 1 CD/DVD drives D: 


Please note, unmodified Samsung MS25’s have no FirmGuard therefore do not need an unlock 
method to be applied, simply click Intro / DevicelD and check flash chip properties for status 
0x70. 
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|_ FimwareTool 32_| DVDKey 32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel | 


VO Port USB Only ©] VIA ports Only 
0000 ~ [..] Include non-DE Ports 


Port Properties 
VO Address: 0x0000 


Master 


Device: XECUTER X360USB PRO 
(Ver 0.18) 


Drive in Vendor Mode! 


Verified E 


activate.iso 


360 Tools 


SST(SST39SF020) 
262144 bytes 
Parallel flash with Status 0x70 


== Tasks 


Sending Vendor Intro to port 0x0000 
Parallel flash found with Status 0x70 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxBF 

Device ID: OxBé 

Flash Name: SST(SST39SF020) 

Flash Size: 262144 bytes 


Now CLICK HERE to proceed 
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Q 
Q 
AS Nee N EA 


Connect any 
SATA device 
to any 
PC or laptop 
via USB 


TIn 


wopiail 


Unlocking the drive. 


Before we can do anything to the drive, it must be in Vendor Mode (status 0x70). 


All Unlocking is taken place under the MTKFlash 32 tab. 


Firmware Tool 32 DVDKey 32 MTK Flash 32 | Hitachi GDR3120 


| Se Vanna ental tense | User Guide 


FimwareTool32 | DVDKey32 | MTK Fash32 | HitachiGDR3120 | IRC Channel 


1/0 Port VIA ports Only ee activate.iso 
~ |. J) Include non-IDE Ports [7] 
— | BOR See | ut 
I/O Address: OxE800 
Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: 
Postion: Master Device ID: 
Device: VIA VT6421 RAID Controller Name: 
Size: 
Type: 
DVD-ROM TS-H943A ‘sgl eer 
| Intro /Device ID] | Outro /ATAReset | 


Read Erase Write 


Verified E 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. 

Drive is Samsung.. 

Key NOT in KeyDB 

Key is: 7131840BC423EA16F92CC9097F166A33 


Key has been tested and verified, thanks C4deve ! 


Note: Upon selecting the correct port the drive shows up and key is dumped and verified 
against the drive! (Before doing anything to the drive) — The firmware has NOT yet been 


dumped! However if you save the log you now have a known verified key from your drive. 
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m 


Simply click Intro / DevicelD and check flash chip properties for status 0x70. 


Flashing Tasks 
[ozman] 
[ Read | [Ees] [wie] 


FimwareTool 32 | DVDKey32 | MTK Fash32 | Hitachi GDR3120 | IRC Channel 


1/0 Port VIA Bctivate isc 
serine! 360 Tools 
E800 ~ [...] Include non-IDE Ports [7 
itean 
Port Properties UnLoek UnLock Usbock 
I/O Address: OxE800 
Type: SATA Flash Chip Properties 


Channel: Primary Vendor ID: OxBF 

Postion: Master Device ID: O0xB6 

Device: VIA VT6421 RAID Controller : SST(SST39SF020) 
262144 bytes 


Drive Properties 
Vendor: Drive in Vendor Mode! 
Name: 
Fiw Rev: 


Parallel flash with Status 0x70 


Reserved: 
DVD Key: Verified E 


Sending Vendor Intro to port 0xE800 
Parallel flash found with Status 0x70 


Sending Device ID request to port 0xE800 
Manufacturer ID: OxBF 

Device ID: OxBé 

Flash Name: SST(SST39SF020) 

Flash Size: 262144 bytes 


Now CLICK HERE to proceed 
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Lm] 


4 


Stock MS28’s (Unmodified). 


Sammy Unlock. 


Select correct I/O Port (check for TS-H943 in the Drive Properties) and click Sammy Unlock. 


|_FimwareTool 32 | DVDKey 32} MTK Fash 32 | Htachi GDR3120-|_IRC Channel 


activate.iso Q 
VO Port USB Only [ VIA ports Only 360 Tools HARTAT NTETE 
@0000 ~ [k] Include non-DE Ports [7 ae fe LiteOn | | Sim 
s UnLock UnLock Erase UnLock 
Fot Poets P Connect any 
ess: 0x0000 A g 
a a Flash Chip Properties SATA device 
Channel: Primary eee to any 
Device ID: 
Postion: Master ae PC or laptop 
Device. XECUTER X360USB PRO ga via USB 
( Ver 0.18) Size: 
Drive Properties Type 
Vendor: TSSTcorp Flashing Tasks 
Name: DVD-ROM TS-H943A intro / Device ID Outro / ATA Reset 
F/W Rev: ms28 
Reserved: [Read] [Eese i) [ wie | 
DVD Key: Verified F Phat © © Slim 
portio32.sys Driver Installed a 


portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.18 


Found 11 I/O Ports. 
Found 0 Com Ports. 


Found 9 windows drives C: D: E: F: G: H: I: J: K: = HOr 
Found 1 CD/DVD drives D: X360USB PRO 


You will be presented with the following warning notifying you that Sammy Unlock only works 
on stock drives & drives with iX LT firmware and how to unlock if using (i)Xtreme. 


N Sammy_Un_Lock will unlock a Samsung M528 with stock f/w and LT 
y and LT+ flashed drives. 
For iXtreme ver 1.4 and before, unlock using 0800 DVD. 
For iXtreme 1.5, unlock drive by powering up with tray half open. 
Do you wish to proceed anyway ? 
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Select yes and watch the Running Log in JungleFlasher; this is a ‘good’ return message, 


JungleFlasher will also automatically send the intro command and put the drive in Vendor 


Mode. 


Sending Sammy Un_Lock to Drive on port OxE800 


Stage 1, Complete! 
Complete! 
Stage 3, Complete! 


Stage 2, 


Done! 


Sending Vendor Intro 


The drive should be in Vendor Mode (0x70) now and return good flash chip properties; you can 
check under Flash Chip Properties, Drive Properties should show “Drive in Vendor Mode!” 


lä 
# JungleFlasher 0.1.79 Beta 


FimwareTool 32 | DVDKey32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel 
activate iso 
JDPI USB Only [©] VIA ports Only 360 Tools 
@x0000 ~ [4] include non-DE Ports [7 E fid kegy | an 
TEET UnLock | | UnLock | | Erase | | UnLock 
I/O Address: 0x0000 ZW 
Type: USB 
Chena ey Vendor ID: OxBF 
Postion: Master Terrae LD 
Device: XECUTER X360USB PRO Name: SIGS 
(Ver 0.18) Size: 262144 bytes 
a ane Parallel flash with Status 0x70 
Vendor: Drive in Vendor Mode! F TA Tasks 
Nama (into / Device ID} [ Outro /ATA Reset] 
F/W Rev: 
Reserved: [Read | | Erase | | wie | 
DVD Key: Verified f Phat @ © Slim 


Manufacturer ID 
Device ID: OxBé 
Flash Name: 
Flash Size: 


age 2, Complete! 
Stage 3, Complete! 
Done! 
Sending Vendor Intro 
Requesting Device ID 


z: OxBF 


SST (SST39SF020) 
262144 bytes 


m 


4 | 


Presents 


The Hottest 
Product of 


2011! 


@X360USR a 


WORLD WIDE SHIPPING 


Now CLICK HERE to proceed 
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Xtreme 3.3 -> iXtreme 1.4 Unlock using Activate.iso. 


For this you need the Activate.iso found in the upper right hand corner of the MTKFlash 32 tab, 


— 


360 Tools 
DHAS 
UnLock UnLock Erase UnLock 


burnt to Dual Layer + R Media (this is vital for later firmwares). Simply burn it with no 
layerbreak settings, with all data present on first Layer, IMGBurn 2.5.0.0 will do this fine just 
select the ISO and confirm you want to burn to a large capacity disc with all data present on LO 
(Layer 0). 


Once burned, simply place it in your Samsung drive while connected to the PC, wait 30 seconds 
and run JungleFlasher. 


Unlocking the drive. 
Before we can do anything to the drive, it must be in Vendor Mode (status 0x70). 
All Unlocking is taken place under the MTKFlash 32 tab. 


| FimwareTool 32 | DVDKey 32 |] MTK Fash 32 Î|_ Hitachi GDR3120 | 


Source | Inquiry | Identify | Drive Serial 


User Guide 


You will presented with a screen resembling this, select correct 1/0 Port (check for TS-H943 in 
the Drive Properties) 


click Intro / Device ID and then check the Running Log. 
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| Firmware Tool 32 | DVDKey 32 | MTKAash 32 | Hitachi GDR3120 | IRC Channel 


1/0 Port VIA ports Only activate.iso 
360 Tools 
Sy (f Include non-DE Ports [7 
Beng Sammy 
Port Properties UnLock TE E A AE 
I/O Address: OxE800 
Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: 
Postion: Master Device ID: 
Device: VIA VT6421 RAID Controller Name: 
Size: 


Type 
DVD-ROM TS-H943A Flashing Tasks 


om | Intro / Device ID Outro / ATA Reset 


Verified E 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. 

Drive is Samsung.. 

Key NOT in KeyDB 

Key is: 71318A0BC423EA1EFS2CCS097F166A33 

Key has been tested and verified, thanks C4eva ! 


m 


If Activate.iso worked correctly, you will get good flash chip properties (0x70) and drive will 
appear in Vendor Mode in Drive Properties. 


Port Properties | Unlock | | UnLock J |S 
VO Address: OxE800 i 
Type: SATA Rash Chip Properties 
Channel: Primary Vendor ID: OxBF 
Postion: Master Device ID: OxB6 
Device VIA VT6421 RAID Controller i SST(SST39SF020) 
262144 bytes 
Drive Properties Parallel fash with Status 0x70 
Vendor: Drive in Vendor Mode! 
Flashing Tasks 
intro /Device ID | (_ Outro/ATAReset | 
FAN Rev: = “ 


Now CLICK HERE to proceed 
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Things not going as expected? — Read the FAQ’s 


Unlocking iXtreme 1.5 > 1.61 


For this method, we still need to power on the drive with the “half open tray”. 


If using a 360 to power the drive 


This method can be tricky to accomplish. 


You need to power on the drive with Eject status closed but Tray Half Open — To do this using 

an Xbox 360 as Power source, eject the DVD drive, then, press eject to ‘close’ the tray. Now this 

is the important part — you MUST remove the DVD power plug from the DVD Drive BEFORE it 
closes fully. 


Wait for a few seconds and replace the power plug into the DVD drive taking extreme caution 
to plug the plug the right way around — once done, the drive is now powered, console thinks its 
closed but it is in fact half open. 


If using a connectivity kit to power the drive 


You need to power on the drive with Eject status closed but Tray Half Open — To do this using a 
connectivity kit as Power source, eject the DVD drive, then, press eject to ‘close’ the tray. Now 
this is the important part — you MUST switch off the power BEFORE it closes fully. 


Wait for a few seconds and switch power on connectivity kit back on — once done, the drive is 
now powered, console thinks its closed but it is in fact half open. 


Load JungleFlasher, and select MTKFlash 32 tab. 


Firmware Tool 32 DVDKey 32 MTK Fash 32 {| Hitachi GDR3120 | 


Source | Inquiry | Identify | Drive Serial User Guide 


Press Intro / Device ID button 


Flashing Tasks 
Ceman) Cam 
Read Erase Write 


The drive should be in Vendor Mode (0x70) now and return good flash chip properties, you can 
check in the Running Log or Flash Chip Properties, The drive should also show as “Drive In 
Vendor Mode!” in the Drive Properties. 
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Things not going as expected? — Read the FAQ’s 


FimwareTool 32 | DVDKey32 | MTKFlash32 | HitachiGDR3120 | IRC Channel 


VO Port 


Type: 
Channel: Primary 

Postion: Master 

Device: VIA VT6421 RAID Controller 


VIA ports Only 


OxE800 ~ [..] include non-DE Ports [v7 


Port Properties 
I/O Address: OxE800 


SATA 


Drive in Vendor Mode! 


activate isa 
360 Tools 
Beng Sammy Lite-On E 


Flash Chip Properties 
Vendor ID: OxBF 
Device ID: OxB6 

SST(SST39SF020) 
262144 bytes 


Parallel flash with Status 0x70 


Sending Vendor Intro to port OxE800 


Parallel £1 


ash found with Status 0x70 


Sending Device ID request to port 0xE800 
Manufacturer ID: OxBF 


Device ID: 
Flash Name: 
Flash Size: 


OxBé 
SST (SST39SF020) 
262144 bytes 


Now CLICK HERE to proceed 


Page 25 of 272 


Things not going as expected? — Read the FAQ’s 


E 


4 


DevicelD Unlock / Vcc Trick (VIA/Nforce only) Stock + Modified Drives. 


This method has only really been tested on VIA (no drivers, or 530c drivers) and Nforce Chipsets, 
although there is no harm in trying on others, this method works on Hacked and Stock Drives. 


Load JungleFlasher, and select MTKFlash 32 tab. 


$ JungleFlasher 0.1.79 Beta 


|_FimwareTool 32 | DVDKey 32 [MTK Fash 32 |/Htacti GOR3120 | IRC Channel | 


Select correct I/O Port (check for TS-H943 in Drive Properties) and click Intro / Device ID. 


i 
 JungleFlasher 0.1.79 Beta 


FimwareTool 32 | DVDKey32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel 


activate.iso 

I/O Port USB Only [] VIA ports Only [¥ 360 Tools 
OxE800 ~ [| Include non-IDE Ports [V k | | | ez | | | 
men : UnLock UnLock Erase UnLock 

I/O Address: OxE800 

= me Flash Chip Properties 

Channel: Primary = 

ae CUR Device ID 

Device: VIA VT6421 RAID Controller ga 

Size 

l : Type: 
Drive Properties 

Vendor: TSSTcorp Flashing Tasks 

Name: DVD-ROM TS-H943A Intro / Device ID Outro / ATA Reset 


Fiw Rev: ms28 
eee Read Erase Write 


DVD Key: Verified E Phat © © Slim 


Found 0 Com Ports. a 
Found 12 windows drives C: D: E: F: G: H: I: J: K: L: M: N: 
Found 1 CD/DVD drives D: 


Key NOT in KeyDB 

Key is: 64F9012B2EEA0017F1A635C71319925A 

Key has been tested and verified, thanks C4eva ! 
Drive is Samsung.. 


m 


ee eee 
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Things not going as expected? — Read the FAQ’s 


JungleFlasher will prompt you with instructions. 


in — 
MTK Vendor Intro failed = 
ee 


= ) If you wish to resend the command you should click Yes. 
‘Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click Yes the Running Log will display something similar to this. 


Sending Vendor Intro to port OxCFOO 
Invalid Status 
Re-sending Vendor Intro: 


When... Are appearing, do as previously instructed by JungleFlasher. Power off the drive 
then, within 1 second, power it back on. 


The drive should be in Vendor Mode (0x70) now and return good flash chip properties, you can 
check in the Running Log or Flash Chip Properties, The drive should also show as “Drive In 
Vendor Mode!” in the Drive Properties. 
Port Properties | Unlock | | UnLock | | Erase | | Unlock | 
VO Address: OxE800 
Type: SATA 
Channel: Primary 


Flash Chip Properties 
Vendor ID: OxBF 


Postion: Master Danta d Mans 


Device: VIA VT6421 RAID Controller 


Name: SST(SST39SF020) 
Size: 262144 bytes 


Dire Panai Type: Parallel flash with Status 0x70 


Vendor: Drive in Vendor Mode! Fana Take 

mn [ intro / Device ID | [ Outro /ATA Reset] 
F/W Rev: 

Reserved: | Read | | Erase | | Write | 
DVD Key: Phat ©) © Slim 


Now CLICK HERE to proceed 


If it didn’t work — read on 
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Things not going as expected? — Read the FAQ’s 


Alternate method if you are struggling with the above 


Load JungleFlasher, and select MTKFlash 32 tab. 


ose O 
FirmwareTool 32_| DVDKey 32 | MTK Fash 32 


Select correct I/O Port (check for TS-H943 in Drive Properties) and click Intro / Device ID. 


a reacer O 


USB Only VIA ports Only [V] 


pe Include nonsDE Pots 


Port Properties 
I/O Address: OxE800 


VIA VT6421 RAID Controller 


Drive Properties 
Vendor: TSSTcorp 
Name: DVD-ROM TS-H943A 
Fiw Rev: ms28 
Reserved: 
DVD Key: 


Found 0 Com Ports. 
Found 12 windows drives C: D: E: F: G: H: I: J: K: L: M: N: 
Found 1 CD/DVD drives D: 


Key NOT in KeyDB 

Key is: 64F9012B2EEA0017F1A635C71319925A 

Key has been tested and verified, thanks C4eva ! 
Drive is Samsung. .- 
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Things not going as expected? — Read the FAQ’s 


JungleFlasher will prompt you with instructions. 


lk a- 
MTK Vendor Intro failed b> 
e 


i s , If you wish to resend the command you should click Yes. 
Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


— 


Then click YES, 
Click Yes the Running Log will display something similar to this. 


Sending Vendor Intro to port OxCFOO 
Invalid Status 
Re-sending Vendor Intro: 


When ...... . Are appearing, 


The drive should be in Vendor Mode (0x70) now and return good flash chip properties, you can 
check in the Running Log or Flash Chip Properties, The drive should also show as “Drive In 
Vendor Mode!” in the Drive Properties. 
| UnLock | | UnLock | | Erase | | UnLock | 


Port Properties 
I/O Address: OxE800 


Type SATA Flash Chip Properties 
Vendor ID: OxBF 
Device ID: 0xB6 


Channel: Primary 


Postion: Master 


Device: VIA VT6421 RAID Controller SST(SST39SF020) 


262144 bytes 
Parallel flash with Status 0x70 


Drive Properties 
Vendor: Drive in Vendor Mode! pes 
| intro / Device ID | | Outro/ATAReset | 
| Read | | Erase | | Wie | 
Phat @ Slim 


Now CLICK HERE to proceed 
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Things not going as expected? — Read the FAQ’s 


Reading the Firmware from the drive. 


Now, we would like to read the firmware from the drive first, so select read. 


Flashing Tasks 
[ into / Device ID | [ Outro /ATAReset_ | 


Again, watch the Running Log for constant status updates. 


Firmware reading: 


Getting Status from port OxE800 
Parallel flash found with Status 0x70 


Raag Bank Bë- <....562662060006 
Mamiing Bankes De: ce cokes coe 
Manting Bank 22 22.42 56525520656 
Neang Bank 32 22s ccs ese cs cles 


Once the firmware has been successfully read, JungleFlasher will prompt you to save it. 


Organize v New folder gc= wv (7) 


vir Favorites ^ Documents library 


Arrange by: Folder v 
New folder 


L Recently Change 
J Public 

E Desktop E 
mi Downloads 


EÈ] Recent Places 


a 


Name Date modified Type 


No items match your search. 


J Libraries 
“| Documents 
m) Downloads 
d Music 
(=| Pictures 
B Videos 


-< R ni + 


File name: SAM-OFW.bin y 


Save as type: | Firmware Images (*.bin) X | 


+) Hide Folders 


Once saved, JungleFlasher will then prompt you asking if you would like to auto-load iXtreme 
for Samsung Drives. You must have installed the JungleFlasher Firmware Pack into the same 
directory as JungleFlasher.exe if you wish to benefit from this feature. 
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Things not going as expected? — Read the FAQ’s 


IF YOU NEED TO RETURN TO STOCK FOR DASH UPDATE CLICK HERE 


- 
Loading Source 


@ Do you wish to auto-load Samsung iXtreme ? 


Click Yes to auto load iXtreme (from the firmware pack) for Samsung into the Target Buffer, 
JungleFlasher will also load your previously dumped Sam-OFW.bin as Source Firmware. Then, 


copy data from Source to Target automatically. 


no multiple FF / 00 / 77 bytes 


Just verify Source data reports as it should, OSIG of TSSTcorpDVD-Rom TS-H943 with a key with 


FimwareTool32 | DVDKey 32 | MTK Fash32 | HitachiGDR3120 | IRC Channel 


Source | Inquiry | Identify | Drive Serial 


F:\JF Beta \Firmware\Original\ TS-H943 - MS28 bin 


Save Drive 
Vendor Model Rev Firmware Type DVD Key @ _40EC - p Key 
Samsung TS-H943A MS28 Stock 64F9012B2EEA001 7F1A635C71319925A 
: Open Source 
OSIG:[TSSTcorpDVD-ROM TS-H943Ams28] Fi 
v| Advanced View ( Spock Soumce to. User Guide 


Key Matches = 
Source 


Vendor Model Rev Firmware Type DVD Key @ 4044 


Samsung TS-H943A MS28 LT v1.9 64F9012B2EEA001 7F1A635C71319925A 


OSIG:[TSSTcorpDVD-ROM TS-H943Ams28] 


Target | inquiry | Identify | Drive Serial | 


F:\JFBeta\Firmware\LT-sammy-v 1.9.bin 


To save a firmware file based on what’s currently in Target Buffer click, Save to File. 
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Things not going as expected? — Read the FAQ’s 


Å- = 


Target | Inquiry | Identify | Drive Serial 


F:\JF Beta \Firmmware \\LT-sammy-v 1.9.bin 


Vendor Model Rev Firmware Type DVD Key @ 4044 
Samsung TS-H9434 MS28 LT v1.9 64F9012B2EEA001 7F1A635C71319925A 


B 


OSIG:[TSSTcorpDVD-ROM TS-H943Ams28] 


JungleFlasher will ask you where to save the hacked firmware and what you want to name it, 
and then you can proceed to write the firmware to the drive. 


PROCEED 
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Things not going as expected? — Read the FAQ’s 


Writing Firmware to the drive 


To write the firmware, as long as drive is still unlocked (Vendor Mode) we just click MTKFlash 
32 tab. 


Firmware Tool 32 DVDKey 32 MTK Flash 32 Hitachi GDR3120 


Source | inquiry | Identify | Drive Serial | 


Verfify you have good flash chip properties still. 


WU Adcress: UxESUU 

Type SATA Flash Chip Properties 

Channel Primary Vendor ID: OxBF 

Postion: Master Device ID: OxB6 

Device VIA VT6421 RAID Controller SST(SST39SF020) 

262144 bytes 

Parallel flash with Status 0x70 


Drive Properties 


Drive in Vendor Mode! 


Aashing Tasks 
Intro /Device ID | | Outro/ATAReset | 


Then, click Write. 


Flash Chip Properties 
Vendor ID: OxBF 
Device ID: O0xB6 
Name SST(SST3SSF020) 
Size 262144 bytes 
Type Parallel flash with Status 0x70 


| Intro /Device ID | | Outro/ATAReset | 


[_ eed) (tee) [wae ] 


Write Command, will erase and flash all 4 banks in turn, then read back the flash and verify. 
A series of 16.....’s is JungleFlasher writing the 16 sectors of each bank (4 banks, 0/1/2/3) 


After writing all 64 sectors, signaled by 64 dots (16 dots across 4 banks) JungleFlasher will verify 
what it wrote by reading back and comparing against the Target Buffer. So, what we really 
want to see is Write Verified OK! 
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Things not going as expected? — Read the FAQ’s 


Flash Verification Test ! 


Write verified OK ! 


Ok, now you have flashed your Samsung Drive successfully, 
Power off — connect back to console and test! 


Should you not get Write Verified OK! Please ask for support in the JungleFlasher support 
channel, found at irc.efnet.net - channel #JungleFlasher, or click HERE 


If you have just Returned your drive to stock Firmware to allow you to update 
the console — then update your console using Xbox Live, USB or CD (all 


explained on Xbox Live). 


Then return to the start and follow the tutorial for a STOCK drive. 


RETURN TO START OF TUTORIAL 
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Things not going as expected? — Read the FAQ’s 


BenQ VAD6038 (62430c and 64930c) 


Overview 
The BenQ Drive revision is tackled in a very similar way to the Samsung Drives. 


The steps to modifying / restoring a BenQ Drive follow the basic outline of: 
e Unlocking the Drive 

e Reading the Original firmware 

e Patching Key into hacked Firmware 

e Erasing Drive 

e Writing Drive 


The tutorial will state multiple unlock methods, once drive is Unlocked / In Vendor Mode 
(0x73) you should proceed to the next step of reading the firmware from the drive. 


The following Flowchart Enables you to use the correct method for your drive! 


Alternative method 


| 
> iXtreme 1.5 > for Nforce or Via | 
iXtreme 1.41 iXtreme 1.61 | chipset users. 
Or iX LT+ CLICK HERE | For ALL BenQ Drives 


CLICK HERE | CLICK HERE | 
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Things not going as expected? — Read the FAQ’s 


Unlocking the drive. 


Before we can do anything to the drive, it must be in Vendor Mode (status 0x73), the majority 
of the unlock methods are found under MTKFlash32 tab, 


Half Open Tray Unlock for iXtreme 1.5 > iXtreme 1.61. 


If using a 360 to power the drive this method can be tricky to accomplish as the 360 likes to 
close the DVD Drive after powering it on. 


You need to power on the drive with the Tray Half Open — To do this using an Xbox 360 as 
Power source, eject the DVD drive and then remove the power lead from the Drive. 


Close the tray half way and plug the DVD Drive power cable back into the drive, being VERY 
cautious to ensure the plug is the right way around. 


Using a Connectivity Kit / Xtractor to power the drive. 


The easiest way to do this is to simply use the eject button on your connectivity kit to eject the 
drive tray, power off the connectivity kit, push the tray half in and power back on the 
connectivity kit. 


Ok, now we half the half open tray, we navigate to MTKFlash32 tab if you haven’t already. 


Firmware Tool 32 DVDKey 32 MTK Flash 32 Hitachi GDR3120 


Source inquiry | Identify | Dive Serial User Gui 


Select correct I/O Port then 


Click Intro / DevicelD. 


| Read | | Ees | | Wie | 


If tray status is correct, drive should return good Flash Chip Properties showing status 0x73, 
Drive Properties should show “Drive In Vendor Mode!” 


Page 36 of 272 


Things not going as expected? — Read the FAQ’s 


FimwareTool 32 | DVDKey32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel 
activate.iso 

be USB Only [©] VIA ports Only 360 Tools 
e E 
Port : UnLock Erase 

I/O Address: 0x0000 ZW 

T USB Flash Chip Properties 

ae Pri Vendor ID: OxC2 

Postion: Master Decs D- Ort 

Device: XECUTER X360USB PRO Mac 

{ Ver 0.18) ize: 262144 bytes 

Drive P : Serial flash with status 0x73 

Vendor: Drive in Vendor Mode! 

Name: 

Fiw Rev 

Reserved: 


DVD Key: Not Found 


Sending Vendo 


Serial flash 


Sending Devic 
Manufacturer 
Device ID: Ox 


Flash Name: MXIC(MX25L2005) 


Flash Size: 


x Intro to port 0x0000 a 
found with Status 0x73 

e ID request to port 0x0000 

ID: OxC2 

11 


262144 bytes 


TTI 


NOTE: Please ignore the” DVD Key: Not Found” message in drive properties! (BenQ cannot 


automatically verify key.) 


Once drive is in Vendor Mode, you can proceed with Reading the Drives Firmware. 


CLICK HERE TO PROCEED 
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Things not going as expected? — Read the FAQ’s 


BenQ UnLock Stock/ iXtreme 1.1 -> 1.41 / Xtreme/iXtreme LT Firmware’s Only. 


Please note, BenQ-Un-Lock WILL NOT work on drives that have iXtreme 1.5>1.61 firmware on 
them (please use VCC Trick or Half Open Tray) 


Connect your BenQ drive up via SATA to your PC, power on, and run JungleFlasher. 
After a few seconds you will be taken to the main application. 


Click the MTKFlash32 tab. 
FimwareTool 32 DVDKey 32] MTK Flash 32 9} Hitachi GDR3120 
Source | inquiry | Identify | Drive Serial] User Guide 


Then, select correct I/O Port by verifying PBDS VAD6038 or SATA DVD-ROM shows in the Drive 
Properties and click BenQ UnLock. 


$œ JungleFlasher 0.1.79 Beta 


TK Rash 32 | Hitachi GDR3120_| IRC Channel | 


INFO - Drive could also be 64930C NS 
which has different properties ] VIA ports Only E] 360 Tools as Tyne 


de non-IDE Ports [v] Beng Sammy Lite-On Slim 
UnLock UnLock Erase UnLock 
Drive Properties 


Vendor: PBDS 


ee Flash Chip Properti 
Name: \VAD6038-64930C er 
Vendor ID: 
F/W Rev: 
Device ID: 


Reserved: 


Xecuter 


Presents | 


The Hottest 
Product of 


DVD Key: USB PRO ate 
Size: 
ox Type: 
i Flashing Tasks 
| eee [intro / Device ID | [ Outro/ATAReset | 
| F/W Rev: 6243 
| Reserved: OC [Read | ( Ees | [wie | 
DVD Key: Not Found Phat © Slim 


JungleFlasher 0.1.79 Beta (210) 
Session Started Fri Mar 04 21:41:27 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed | 
portio32.sys Driver Started, thanks Schtrom ! = 
X360USB PRO detected, Version 0.18 


Found 11 I/O Ports. 


JungleFlasher will send the Magic Keys to unlock the drive and should return this message in 


the Running Log. JungleFlasher has also sent the Intro command to the drive. 


Page 38 of 272 


Things not going as expected? — Read the FAQ’s 


Sending Magic Keys to Drive on port OxO0xCFOO 


Sending Vendor Intro 
Requesting Device ID 
Manufacturer ID: OxCZ 
Device ID: Oxll 

Flash Name: MXIC(MXZ5L2005)} 
Flash Size: 262144 bytes 


All 


The drive should be in Vendor Mode (0x73) now and return good flash chip properties, you can 
check in the Running Log, Drive Properties or Flash Chip Properties. 


|_FimwareTool 32 | DVDKey32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


activate.iso 

e a a 
Port Properties UnLock Erase 

I/O Address: 0x0000 AA 

Type: USB Flash Chip Properties 

Channel: Primary Vendor ID: OxC2 

Postion: Master Device ID: 0x11 

Device: XECUTER X360USB PRO Name: MXIC(MX25L2005) 

{ Ver 0.18 ) oo 262144 bytes 

Drive Properties 

Vendor: Drive in Vendor Mode! 

Name: 

Fiw Rev: 

Reserved: 


DVD Key: Not Found 


Sending Vendor Intro 


Requesting Device ID 
Manufacturer ID: OxC2 
Device ID: 0x11 

Flash Name: MXIC(MX25L2005) 
Flash Size: 262144 bytes 


"I 


NOTE: IF USING X360USB Pro the Status DOES NOT INITIALLY SHOW as 0x73 BUT THE DRIVE IS STILL IN 
VENDOR MODE! (press Intro/Device ID again if you wish status to show up) 


Once the drive is in Vendor Mode, you can proceed with Reading the Drives Firmware. 


CLICK HERE TO PROCEED 
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Things not going as expected? — Read the FAQ’s 


DevicelD Unlock / Vcc Trick (VIA/Nforce only) Stock + Modified Drives 


This method has only really been tested on VIA (no drivers, or 530c drivers) and Nforce Chipsets, 


although there is no harm in trying on others, this method works on Hacked and Stock Drives. 


Load JungleFlasher, and select MTKFlash32 tab. 


Firmware Tool 32 DVDKey 32 MTK Flash 32 Hitachi GDR3120 


Source | inquiry | identify | Drive Serial | 


Then, select correct I/O Port by verifying PBDS VAD6038, SATA DVD-ROM shows in the Drive 


04421C which has different properties 


2 | MTKFash 32 | HitachiGDR3120 | IRC Channel | 


Drive Properties 
Vendor: 


VIA E 
or 360 Tools 


activate.iso 


Include non-IDE Ports [V] 


Beng Sammy 
UnLock UnLock 


| ‘en Ease 


Flash Chip Properties 
Vendor ID: 


Type: 
Vendor: 
Name: 


Flashing Tasks 


F/W Rev: 


E (Oa /ATARSS | 


Reserved: | Read | [Erase 


DVD Key: Not Found 


I A E E A D E E E E A E E DA E A A A D E DE A A E E DE A E A A D D D DE A E A E D A E E A D D E D A E E E 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 09:12:32 2010 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. 

Drive is Benq.. 
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Things not going as expected? — Read the FAQ’s 


JungleFlasher will prompt you with instructions. 


r 


MTK Vendor Intro failed 


' =~ ) If you wish to resend the command you should click Yes. 
Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click Yes the Running Log will display something similar to this. 


Sending Vendor Intro to port OxCFOO 
Invalid Status 
Re-sending Vendor Intro: 


When ....... are appearing, do as previously instructed by JungleFlasher. Power off the drive, 
then, within 1 second, power it back on. 


The drive should be in Vendor Mode (0x73) now and return good flash chip properties, you can 
check in the Running Log or Flash Chip Properties, Drive properties should display “Drive in 
Vendor Mode!”. 
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Things not going as expected? — Read the FAQ’s 


Firmware Tool 32 | DVDKey 32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel 


360 Tools 
(E800 ~ [...) Include non-DE Ports 
Beng Sammy 
Pott Properties | UnLock | | UnLock | en nee 
I/O Address: OxE800 
Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxC2 
Postion: Master Device ID: 0x11 
Device: VIA VT6421 RAID Controller Name: MXIC(MX25L2005) 
Size: 262144 bytes 
Drive Properties Type: Serial flash with status 0x73 
Vendor: Drive in Vendor Mode! 
— Flashing Tasks 
FIW Rev: Intro / Device ID Outro / ATA Reset 


Reserved: Read Erase Write 


DVD Key: Not Found 


CLICK HERE TO PROCEED 
If it didn’t work — read on 


Alternate method if you are struggling with the above! 


Load JungleFlasher, and select MTKFlash32 tab. 


Fimware Tool 32 DVDKey 32 § MTK Aash 32 f| Hitachi GDR3120 


Source | inquiry | identify | Drive Serial | 


Then, select correct I/O Port by verifying PBDS VAD6038 or SATA DVD-ROM shows in the Drive 
Properties and click Intro / Device ID. 
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Things not going as expected? — Read the FAQ’s 


INFO - Drive could also be 


62430C/04221C which has different 


properties || MTK Flash 32 | HitachiGDR3120 | IRC Channel 


Drive Properties 
Vendor: 


activate.iso 


VIA ports Only 
Include non-IDE Ports |V 


[oie | [Soa | [oe] 


F/W Rev: 


Reserved: Read Erase Write 


DVD Key: Not Found 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 09:12:32 2010 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. 

Drive is Benq.. 


JungleFlasher will prompt you with instructions. 


r 
MTK Vendor Intro failed . ed 


PỌ Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click Yes, the Running Log will display something similar to this. 
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Things not going as expected? — Read the FAQ’s 


Sending Vendor Intro to port OxCFOO 
Invalid Status 
Re-sending Vendor Intro: 


The drive should be in Vendor Mode (0x73) now and return good flash chip properties, you can 
check in the Running Log or Flash Chip Properties, Drive properties should display “Drive in 
Vendor Mode!”. 


FimwareTool 32 | DVDKey 32 


MTK Flash 32 | HitachiGDR3120 | IRC Channel 


VO Port VIA ports Only F] activate.iso 
360 Tools 
(E800 ~ [k] Include non-DE Ports [7] 
Beng Sammy 
Port Properties | UnLock | | UnLock | en Eee 
I/O Address: OxE800 
Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxC2 
Postion: Master Device ID: 0x11 
Device: VIA VT6421 RAID Controller Name: MXIC(MX25L2005) 
Size: 262144 bytes 
Drive Properties Type: Serial flash with status 0x73 
Vendor: Drive in Vendor Mode! 
P= Flashing Tasks 
s Intro / Device ID Outro / ATA Reset 
Fiw Rev: 


Reserved: 
DVD Key: Not Found 


Read Erase Write 


CLICK HERE TO PROCEED 
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Reading the Firmware from the drive. 


Now, we would like to read the firmware from the drive first, so select read. 


Drive Properties Type: 
Vendor: PBDS 
Name: VAD6038-64930C Rashing Tasks 
: Intro / Device ID Outro / ATA Reset 
F/w Rev: 


comer [Rea f L Ese | [ wie | 


DVD Key: Not Found 


Check the Running Log and you will see it reading the firmware from the drive. 


Reading Bank ÜF ccscscdseressass 
Reading Bank: L? sarossd romessens 
Reading Bank 2: . 


KE 


Once the firmware has been read JungleFlasher will prompt you to save the firmware. Name it 
what you wish and select directory path of your choice and click Save. 


E = 
a 
Ge! & « JungleFlasher 0174 Bet... » New folder + | 4] [ Search New fi 
_— w E p e 


Organize v New folder 


CÀ Documents z Name Date modified 
fl Downloads 
d Music 

t| Pictures 
E Videos 


|_| SAM-OFW.bin 22/05/2010 8:23 AM Open 


28 Homegroup 


1 Computer 


E Win 7686) (C) | 


ca DATA (D:) = 


ca Local Disk (E:) 
ca Backup (H:) 
caw Win 7(64) Œ) nail <!)) | + 


File name: BENQ-OFW.bin X 


Save as type: | Firmware Images (*.bin) X 


Once saved, JungleFlasher will then prompt you asking if you would like to auto-load iXtreme 
for BenQ Drives. You must have installed the JungleFlasher Firmware Pack into the same 
directory as JungleFlasher.exe if you wish to benefit from this feature. 
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r 
Loading Source 


$à Benq firmware loaded to Source buffer! 
Ø Do you wish to auto-load Benq iXtreme? 


Click Yes to auto load iXtreme (from the firmware pack) for BenQ into the Target Buffer, 
JungleFlasher will also load your previously dumped BenQ-OFW.bin as Source Firmware. Then, 
copy data from Source to Target automatically. 


Just verify Source data reports as it should, OSIG of VAD 6038 or SATA DVDROM with a key 
with no multiple FF/00/77 bytes. 


Now, verify unique Source Data matches that in Target Buffer and click save to file if you wish 
to backup your Hacked firmware. 


g 
@ JungleFlasher 0.1.79 Beta 


FirmwareTool 32 | DVDKey 32 | MTK Fash 32 | Hitachi GDR3120 | _IRC Channel 


Source Open KeyDb WRIA 
FAJFBeta\BENQ-OFW bin r 
= Save Drive Compatible 
Vendor Model Rev Firmware| i, with Xbox 360 
Beng VAD6038 64930C Stock . 
aes DVD drives 
OSIG:[PBDS VAD6038-64930C ] , Fimware Hitachi, 
User Guide Samsung, 
eS Beng & Liteon 
Open Target 
Manual 
Hele) Voge R =y imwa = pe Spoofing 
Benq VAD6038 64930C  LT-Plus 1.1 
OSIG:[PBDS \VAD6038-64930C ] 


Firmware Osig: [PBDS VADE038-64930C 
Firmware is: LT-Plus 1.1 

Spoofing Target 

DVD Key copied to target 

ID strings already match 

Serial data copied from Source to Target 


@X360USBG 


Loading MIK_Flash source file 


4 [m 


(This Example is for PRE-DASH 13146, FOR POST-DASH UPDATE Rev will be 04421, Target will be 
LT+1.91 FW Type). 
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You can now save the Target Buffer to file by clicking Save to File. 


[Tana | Open Target 


F:\JF Beta \Fimmware\LTPlus-beng-v1.1.bin 


Vendor Model Rev Firmware Type DVD Key @ E040 
Beng VAD6038 64930C LT-Plus 1.1 1AB34C0258B0AB2B2ABSDC3B0CB62D02 


OSIG:[PBDS \VAD6038-64930C ] 


Writing Firmware to the drive. 


To write the firmware, as long as drive is still unlocked (Vendor Mode) we just 
click MTKFlash 32 tab. 
FimwareTool 32 | DVDKey 32 | MTK Fash 32 I} Hitachi GDR3120 | 


Source | inquiry | identify | Drive Serial | 


Verfify you have good flash chip properties still. 


Flash Chip Properties 

Vendor ID: OxC2 

Device ID: 0x11 
MXIC(MX25L2005) 


262144 bytes 
Serial flash with status 0x73 


[intro / Device 1D | 


| Outro / ATA Reset | 


| 


Then, click Write. 
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Vendor ID: OxC2 

Device ID: 0x11 

Name: MXIC(MX25L2005) 
Size 262144 bytes 


Type Serial flash with status 0x73 


Intro / Device ID | Outro / ATA Reset | 


feed) (eee) [vee] 


Write Command, will send Chip Erase prior to writing and then proceed to write the 4 banks of 
the firmware (banks 0/1/2/3). 


A series of 16.....’s is JungleFlasher writing the 16 sectors of each bank (4 banks, 0/1/2/3). 


Sending Chip Erase to Port OxE800 
Writing target buffer to flash 
Sree Bask Cs s.cc sc cers cscs 
Wettig Beak 2s occas E 
Writing Bank 22 <.2:.<222c2<e 225055 
Sette Beek Ss sccc st cte eos 


After writing all 64 sectors, signaled by 64 dots (16 dots across 4 banks) JungleFlasher will verify 
what it wrote by reading back and comparing against the Target Buffer, what we really want to 
see is Write Verified OK! 


Flash Verification Test ! 
Tan Bank: Be uharan n 
Hanino Benk I: 2. soos ees 
Reading Bank 2: -......--------- 
Rahim Bem: Bs ssrdsn 
Write verified OK ! 


Now send an Outro to the drive. 


Flashing Tasks 
| Intro/ Device ID | |) Outro / ATA Reset 
Read | Erase o Wie 


This will release a drive from Vendor Mode and send ATA Reset to the Drive. It then sends an 
inquiry command to the drive. 


This will save you power cycling the drive and then changing port away and change it back 
again, with the click of a button, drive will ‘reset’ itself and JungleFlasher will send an inquiry 
command to the drive. If successfully flashed the drive should Inquire correctly and display 
drive properties. 
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PRE- DASH UPDATE 


Drive Properties Drive Properties 
Vendor PBDS Vendor: 
Name: VAD6038-64930C Name: 

F/W Rev Fiw Rev: 
Reserved: Reserved: 
DVD Key Not Found DVD Key: 


POST DASH UPDATE 


Drive Properties 
Vendor: PBDS 
Name: VAD6038 
Fiw Rev: 0442 
Reserved: 1C 


DVD Key: Not Found 


SATA 
DVD-ROM 
6243 

oc 

Not Found 


Which drive properties you have depends on BenQ FW version! 


Power off — connect back to console and test! 


CLICK HERE TO RETURN TO START OF TUTORIAL 
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Hitachi GDR-3120L. 
Rom Versions 32/36/40/46/47/58/59/78/79. 
Overview. 


Hitachi drives are completely unique in the way and which they are modded. We modify 
Hitachis on a sector by sector basis. For this to happen the drive must be in Mode-B (mode-b 
allows windows to recognise the drive!) there are several transfer methods available (some 

only to certain revisions) But RAM Upload can be used for all drives! 


JungleFlasher can be used over Windows API or PortlO. 


Use Win API 


Use Port 10 @ 


WinAPI should used where possible, although WinAPI requires the drive to be assigned a drive 
letter, this isnt possible with a VIA 6421 with Drivers Removed. 


PortlO functionality was added for VIA 6421 Sata users who removed drivers to hack the Lite- 
On drives without freezing issues. 


To enable PortlO usage, check VIA Ports Only under DVDKey 32 tab. 


VIA ports Only |v 
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Regardless of option chosen, the Hitachi Drive must still be in ModeB, this is essential to be 
assigned a drive letter in Windows, for using WinAPI, but, also vital for PortlO users as most 
dump and flash commands require it. 


JungleFlasher uses a unique way of calculating the checksum of the firmware and JungleFlasher 
will also take over from the user as soon as possible to prevent user error, its not necessary to 
dump the drive to patch the firmware, JungleFlasher will dump before you try to do anything to 
the drive. 


JungleFlasher also incorporates a “Stability Test” prior to modifying the drive, as safety is 
paramount. 


X360USB PRO 


The x360USB Pro is a unique piece of hardware, It incorporates WinAPI and Portio usage when 
flashing a Hitachi (winAPI is a lot faster) so select WinAPI before you start, Jungleflasher will 
automatically switch between the two without user interference. PortlO drivers are not 
required at all when using the X360USB Pro and if you tick USB Only box(DVDKey 32 tab) — you 
will see the PortlO drivers are even unloaded. 


CLICK TO CONTINUE 


Page 51 of 272 


Things not going as expected? — Read the FAQ’s 


| If using USB-SATA convertor — 


Flashed! Use nmi mimi a l | 
Either Method +m — Stock or flashed follow this— CLICK HERE — 
I 
for Mode-B : Firmware? I Stock l 
Nanna nena anne ne ; | (Win XP ONLY) 


ee 


i Setting Mode-B 
Set Mode-Bon | Setting Mode-B 


| CLICK HERE 
Flashed drive CLICK HERE | —— 
CLICK HERE — | =) 
If the flashed 
Drive isa V79 


CLICK HERE | 


: a Drive in Mode-B 
Flashed! Pre-79 | nith stock FW 
You MUST 
Restore First! 
CLICK HERE 


Info — If you have a 
79 that is flashed 
with iX1.51 there is 
no need to unlock — 


proceed down on 


flowchart 
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Setting ModeB 


Connect your Hitachi Drive via sata, power it on, then open JungleFlasher and you will be 
presented with the welcome screen 


Then, click the Hitachi GDR-3120 tab 


FimwareTool 32 | DVDKey 32 | MTKFlash 32 | HitachiGDR3120_| IRC Channel 


You will be presented with the dedicated Hitachi tab shown below (or similar to) 


FimwareTool 32 | DVDKey 32 | MTKAlash32 | HitachiGDR3120 | IRC Channel 


ES Use Win API © = 
A000 v > 
m Use Port IO 
a Drive Revision [ Refresh | [ Scan | { Query | | USmodeB | 
Name: DVD-ROM GDR3120L 32/400 
3E Flashing Options Sector List 
F/W Rev: 0059 = D Drive © 
46/470 
Reserved: OBMAB 06/01/24 Manual Spoof © 
58/59@ g 
Auto Spoof © 
Send Mode-B 78/70 i 
Flash iXtreme () 
l Open [ Close | Transfer Method finden hmp 
Classic @) 
79 Unlock Set Checksum (©) 
automatic [V] Mode Select © 
Insert the 79 Unlock Audio CD. i Free Flash 
Ram Upload ©) 
Play Read to Source 
DRS 
This is a 32 bit process running on 4 x 32 bit CPUs a 


portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. — 
Drive is Hitachi.. Drive key F8FED0A9C49AC7CD765F96092E6118E4 


m 


Key NOT in KeyDB 
Key is: F8FEDOA9C49AC7CD765F96092E6118E4 
Key has been tested and verified, thanks C4eva ! 


Note the Hitachi Drive inquires on my I/O Port and that PortlO is disabled (using non-VIA 
chipset) 
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MTK ash 32 | Hitachi GDR3120 | IRC Channel 


Use Win API © = 
Use Port 1O us 
Vendor: HL-DT-ST z S | 
Drive Revision [_ Sean | 
Name: DVD-ROM GDR3120L 32/40 € 
O Flashing Options Sector List 
F/W Rev: 0059 S D Drive @ 
46 / 47C g 
Reserved: OBMAB 06/01/24 Manual Spoof ©) 
58 /59@ 2 
Auto Spoof © 
Send Mode-B 78/79 © 2 
Flash iXtreme () 
Transfer Method Restore Fimware © 
Classic ©) 
79 Unlock Set Checksum © 
automatic [v] Mode Select ( 
Insert the 79 Unlock Audio CD. i Free Flash 
Ram Upload © 
Play 79 Unlock Read to Source 
y | [Unlock | ee 
This is a 32 bit process running on 4 x 32 bit CPUs a 


portio32.sys Driver Installed 
portio32.sys Driver Started, thanks Schtrom ! 


Found 0 Com Ports. 


Drive is Hitachi.. Drive key F8FEDOASC49AC7TCD7ESF96092E6118E4 


Key NOT in KeyDB 


m 


Key is: F8FEDOA9C49AC7CD765F96092E6118E4 
Key has been tested and verified, thanks C4eve ! 


The drive needs to inquire on I/O port for Raw ModeB Commands to work (this applies to 


spoofed drives also) 


Once it inquires, Click send ModeB, you will be presented with the following message, do as 


It states, as the ModeB built in on some Connectivity Kits, can cause issues. 


e 


ra 
ravos coa E 


You are about to send the mode-B command to your Hitachi Drive. 
For Best results open drive tray now and power off the drive. 

Then press OK to continue. When dots show, power on the drive. 
Drive should respond to normal windows Inquiry and close. 

Wait 15 seconds for Windows to recognise drive.. 


When done, it's important to confirm Mode-B with double press to 
open and close drive tray. 


Press Escape to cancel. 


aS Gaal 
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The drive should now report as in ModeB 


Drive, answers normal Windows Inquiry 12 000 24 0 


0000: 0S 80 00 32 SB 00 00 00 - 48 4C 2D 44 54 2D 53 54 ...2[..-HL-DT-ST 
0010: 44 56 44 2D 52 4F 4D 20 - 47 44 52 33 31 32 30 4C DVD-ROM GDR3120L 
0020: 30 30 35 39 0059 


Mode-B Done! 
Scanning for hardware changes 


Found drive C: - Hard Drive. 
Found drive D: - Hard Drive. 
Found drive E: - Hard Drive. 
Found drive F: - CD/DVD. <--- Hitachi found 


Found drive G: 


CD/DVD. 


Once ModeB is set, if using WinAPI, JungleFlasher will scan for hardware changes automatically 
after 15 seconds (if using vista/win 7 ensure you run jungleflasher as administrator) if drive 
does not show up then scan for changes in device manager! 


WinAPI users should see similar to this under the ‘Drive’ section 


Drive 
FA [HL-DT-STDVD-ROM GDR3120L0059] z 
| Refresh | | Scan || Query | | USmodeB 


If not, click Refresh List 


JungleFlasher WILL NOT scan for Hardware Changes after setting ModeB for PortlO users. The 
Drive will NOT appear in drive list on right hand side! 


Instead, the tasks are carried out, as long as the drive Inquires on the I / O Port 


Port Properties 


00000 ~| (as) 


Vendor: HL-DT-ST 
Name: DVD-ROM GDR3120L 
Fiw Rev: 0059 


Reserved: OBMAB 06/01/24 


( Open || Cose | 


BACK TO FLOWCHART! 
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Mode B on an already flashed drive 


Mode B can be easily achieved on a pre-flashed Hitachi 


Ensure SATA cable connected to pc! 


To do this using a Xbox 360 console for powering the drive; 
1. Eject the drive 
2. Pull the power cable from the rear of the DVD-Rom 
3. Plug cable back in (ensuring correct orientation of plug) 
4. The drive tray will close (if pre-flashed) 
5. Check that it takes 2 presses to eject and 2 or 3 to close. 

Your drive is now in Mode B 
Using a connectivity kit / power dongle 

1. Eject drive using button on kit 

2. Switch power off, then on again 

3. The drive tray will close (if pre-flashed) 

4. Check that it takes 2 presses to eject and 2 or 3 to close. 

Your drive is now in Mode B 
Start Jungleflasher — click on Hitachi Tab, ensure correct I/O port 
If using WinAPI — drive should show in drive list on right hand side! 


If using PortlO option — drive should be visible in port on left hand side 
ONLY! 


CONTINUE ON FLOWCHART 
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JungleUSB Drivers and USmodeB (XP ONLY) 


JungleUSB is a hacked USB Storage driver that enables windows to see a Mode A drive over 
USB, this enables USmodeB command to be sent and the drive. 


Installing JungleUSB Driver 


(can be downloaded from the usual places). 


First you need to connect the drive to your PC with a SATA-USB Bridge Adapter 
Windows will automatically install the device as 


USB Mass Storage Device 


You will need to update driver and install JungleUSB 


Open Device manager and Find USB Mass Storage Device under Universal Serial Bus 
Controllers. Right click on it and Update Driver. 


= eS Universal Serial Bus controllers 
& SiS 7001 PCI to USB Open Host Controller 
& SiS 7001 PCI to USB Open Host Controller 
& USB Composite Device 
BFA Usb Mass Storage Device! 
> USB Root Hub 
&> USB Root Hub 

+, BB Xbox 360 I/O Device Drivers 


m 


Select No, not this time. Then click Next 
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Hardware Update Wizard 


Welcome to the Hardware Update 
Wizard 


Windows will search for current and updated software by 
looking on your computer, on the hardware installation CD, or on 
the Windows Update 


Can Windows connect to Windows Update to search for 
software? 


© ‘Yes, this time only 
© Yes, now and every time | connect a device 
@ No, not this time 


Click Next to continue. 


Select Install from specific location and click Next 


Hardware Update Wizard 


This wizard helps you install software for: 


USB Mass Storage Device 


( *) If your hardware came with an installation CD 
QE or floppy disk, insert it now. 


What do you want the wizard to do? 


© Install the software automatically (Recommended) 
@ di 


Click Next to continue. 


l <Back | Next> ] i Cancel | 


Select Don`t search I will choose the driver to install and click Next. 
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Hardware Update Wizard 


Please choose your search and installation options. 


© Search for the best driver in these locations. 


Use the check boxes below to limit or expand the default search, which includes local 
paths and removable media. The best driver found will be installed. 


Choose this option to select the device driver from a list. Windows does not guarantee that 
the driver you choose will be the best match for your hardware. 


(cite) (tana) 


Click Have Disk 


Hardware Update Wizard 


Select the device driver you want to install for this hardware. 


Select the manufacturer and model of your hardware device and then click Next. If you 
fee have a disk that contains the driver you want to install, click Have Disk. 


|¥] Show compatible hardware 


(Have Disk... ] 


Now click Browse and Navigate to JungleUSB.inf (can be downloaded from the usual 
places). 
Select it and click Open. Then click OK 
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Select the device driver you want to install for this hardware. we 


Y 


Insert the manufacturer's installation disk, and then 
make sure that the correct drive is selected below. 


| Cancel ] 


Copy manufacturer's files from: 


Ey 


Now click next and the Driver should install. 


Hardware Update Wizard 


Select the device driver you want to install for this hardware. 


Select the manufacturer and model of your hardware device and then click Next. If you 
fea have a disk that contains the driver you want to install, click Have Disk. 


[V] Show compatible hardware 


Model 
Jungle USB 360 Mass Storage Driver 


This driver is not digitally signed! f Have Disk... ) 
Tell me why driver signing Is important ggi is 


<Back |f Next> | Cancel m) 


Click finish and Return to Device manager. 
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Hardware Update Wizard 


Completing the Hardware Update 
Wizard 


The wizard has finished installing the software for: 


= JungleUSB 360 Mass Storage Driver 


Click Finish to close the wizard. 


"Finish | 


If all went well you should now have JungleUSB 360 Mass Storage Driver listed under 
Universal Serial Bus Controllers and HL-DT-ST DVD-ROM GDR3120 USB Device listed under 
DVD/CD ROM drives. 


£, Device Manager 


File Action View Help 
Ta R =Ra 


=) 8 DVD/CD-ROM drives 
4b HL-DT-ST DVD-ROM GDR3120L USB Device 
<2 HL-DT-ST DVD-ROM GDR8163B 
<4 PIONEER DVD-RW DVR-LL6D 
+) &} Floppy disk controllers 
wA Floppy disk drives 
+| (gy Human Interface Devices 
+) Gy IDE ATA/ATAPI controllers 
+) “a Keyboards 
m- Mice and other pointing devices 
+) BB Network adapters 
+ Ports (COM & LPT) 
+) RR Processors 
= @ SCSI and RAID controllers 
+) ®, Sound, video and game controllers 
+) System devices 
=). Universal Serial Bus controllers 
& JungleUSB 360 Mass Storage Driver 
ee SiS 7001 PCI to USB Open Host Controller 
_. > SiS 7001 PCI to USB Onen Host Controller 


Now Start JungleFlasher and select the Hitachi GDR3120 tab, Click the USmodeB button 
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[ Fumare tool 32 |- DVDKey 32 | MTK Flash 32_/ HtachiGOR3120 | 


Orive 


- 


Use Port 10 © = 
Drive Revision Refresh Scan Query USmodeB 
40/20 
ce Flashing Options Sector List 
x Dump Drive @ 


Use Win API © 


USmodeB 


You are about to scan for your Hitachi Drive and send USmodeB. 
You will need to use the JungleUSB diver for this to work. 

Connect the USB-2-SATA to the USB port with the dive connected 
and powered on, wait 15 seconds, then press OK. 


Press Escape to cancel. 


JungleFlasher 0.1.59 Beta 
Session Started Sat May 02 17:44:33 20090 


This is a 32 bit process running on a 32 bit CPU 
PortIO is installed and running. 


JungleFlasher will scan for any 360 Hitachi Drives connected via USB and send Mode-b 
Command to that drive. The Drive should now be selectable in the drop down box. 


Dave 


|GAJHLOT-STOVD-AOM GOR T2053 - 


Refresh Scan Query USmodeB 
Flashing Options 
Dump Drive © 
Manual Spoof © 
Auto Spoof © 


Sector Lint 
m 


Found 6 vindovs drives. 
Found 2 CD/DVD drives. 


C:\ [NL-DT-3TOVD-RON CORIIZOLOOS9) returns with norsal Windows Inquiry 
0000: Of GO 00 32 SB 0O 00 OO - 48 4C 2D 46 S4 2D 53 S4 2 HL-DT-ST 
0010: 44 Sé 44 2D S2 áF 4D 20 - 47 44 SZ 33 31 32 BO 4C DVD-ROM COR3S12OL 
0020: 30 30 35 39 30 42 4D 41 - 42 20 20 20 30 36 2F 30 OOSSOBMAB 06/0 
9030: 33 ZF 322 34 20 20 20 00 1/24 


CLICK TO RETURN TO HITACHI FLOWCHART 


Page 62 of 272 


Things not going as expected? — Read the FAQ’s 


Dumping the Firmware from the drive (Pre v78) 


Older ROM Versions of the drive, v32, v36, v40, v46, v47, v58 and v59 are dumped using Classic 
Mode, Mode Select, or RAM upload. For the purpose of the tutorial, l'Il use Mode Select 


** Dumping the firmware from a Drive Using ‘Classic Mode’ will be fooled by firmware 


stealth, this means, it WILL report as stock even though it isnt. ** 


As the drive is in ModeB already, we simply ensure drive revision matches that of the drive 


| Fimware Tool 32. | DVDKey 32 | MTKAash 32 | Hitachi GDR3120 | 
Port Properties 


Vendor: HL-DT-ST 


(A000 


Name: DVD-ROM GDR3120L 


FM Rev 


0059 


Reserved: OBMAB 06/01/24 


Found 
Found 
Found 
Found 
Found 
Found 
Found 
Found 
Found 


drive 
drive 
drive 
drive 
drive 
drive 
drive 
drive 
drive 


wOBR OA Gh iG 


, G74 £34 2.3 2 T 


Hard 
Hard 
Hard 
Remo 


Remov 
Remov 
Remov 


Use Win API © 


PA [HL-DT-STOVO-ROM GDR312010059} X 


Flashing Options 
Dump Drive @) 
Manual Spoof ©) 
Auto Spoof © 
Flash LT-Plus © 


Restore Firmware C 


Drive. 
Drive. 
Drive. 


vable. 
able. 
able. 
able. 


CD/DVD. 


CD/DVD. 
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<--- Hitachi found 


Select Dump Drive and Mode Select 
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Refresh Scan Query USmodeB 


Sector List 


m 


Firmware Tool 32 Hitachi GDR3120 
Port Properties Use Win API @) Drive 


A000 P:\ [HL-DT-STDVD-ROM GDR3120L0059] X 
Use Port 10 


Vendor: HL-DT-ST Dive Revidon 


Name: DVD-ROM GDR3120L 32/400 


20 Flashing Options Sector List 
F/W Rev: 0059 k 


46/470 
Reserved: OBMAB 06/01/24 


58/59@ 
72/70 
Open Close 


Found drive H: Hard Drive. 

Found drive I: Hard Drive. 

Found drive J: Hard Drive. 

Found drive K: Removable. 

Found drive L: Removable. 

Found drive M: Removable. 

Found drive N: Removable. 

Found drive 0: CD/DVD. 

Found drive P: CD/DVD. <--- Hitachi found 


Then, click Read to Source 
Flashing Options 

Dump Drive @ 

Manual Spoof © 

Auto Spoof © 

Flash LT-Plus © 

Restore Fimware © 

Set Checksum © 

Free Flash 


| Read to Source 


You should see something similar to below 


Page 64 of 272 


Things not going as expected? — Read the FAQ’s 


0020: 30 30 35 39 0059 Ka 


Mode-B Done! 

Scanning for hardware changes 
Found 7? windows drives. 

Found 3 CD/DVD drives. 


Dumping f/w of Hitachi 0058/0059 by Mode Select Method via WIN3Z API =| 
Unlocked! || 


Once firmware is read, JungleFlasher will prompt you to save it. 


a — 

osen == 

gO- m > Computer » DATAU:) » hittest v | 4p] | Search hittest p 
Eo N EÁ — a = = 


Organize v New folder a @ 


= Date modified Type 
ey Homegroup 
No items match your search. 

jl Computer 

& Local Disk (C:) 

a Local Disk (D:) 

a Local Disk (E:) 

a MAIN (H:) 

a Win7 Œ) 

c DATA ():) 


Gy Network 


«| + 


File name: THI-OFWibin S 


Save as type: | Firmware Images (*.bin) z 
~ Hide Folders [swe] 


Upon saving the Firmware from the Drive, you can verify the key appears good and it reports as 


GDR 3120 (ROM Ver) 

ingury | Identity | Drive Serial User Guide 

JNhittest \Hit-OFW bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ 4F00 Ox67178889 o Key 
Hitachi GDR3120L 0059 Stock A5009C9AFB9605702E09494079A2DC36 
| 

; Open Source 

OSIG:[HL-DT-STDVD-ROM GDR3120L0059} | Pm i 


The Running Log should also show this data. 


FLASH iX FIRMWARE - CLICK HERE 
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UNLOCKING v79 


FIRST Ensure ModebB is set 


V79 ONLY 


The Hitachi v79 requires ‘unlocking’ via Audio CD which can be downloaded here 


Burn the .bin, using the cue sheet in IMGBurn (done by right clicking .cue file and selecting 
“burn with imgburn”) and write to CD-R 


Insert the disc into the Hitachi v79, wait for it to spin up (windows media player may try to 
open! - just close it) then click 79 unlock 


|_FimwareTool 32 | DVDKey 32 | MTK Flash 32 


OxCDA0 


Port Properties 


~ bs 


Vendor: HL-DT-ST 


Use Win API @) oe 


Use Port 10O 


Drive Revision 


Hitachi GDR3120 | 


Name: DVD-ROM GDR3120L 32/400 
wO Flashing Options Sector List 
Fiw Rev: 0079 i Dump Drive @ 
46/470 l 
Reserved: OBMAB 06/05/25 Manual Spoof € 
58 /59© 
Auto Spoof € 
| Send Mode-B | 78/76 
Flash LT-Plus € 
Cl z 
| Open || Close | Transfer Method oe € 
79 Unlock gi Set Checksum € 
automatic (V Mode Select f 
Insert the 79 Unlock Audio CD. : Free Hash 
Ram Upload @) 
Play | 793 Unlock ere | Read to Source 
Ram Poke 
Found drive E: - CD/DVD. a 
Found drive G: - CD/DVD. 
No Hitachi drives were found! 
Scanning for hardware changes 
Found drive C: - Hard Drive. 
Found drive D: - Hard Drive. 
Found drive E: - CD/DVD. 
Found drive F: - CD/DVD. <--- Hitachi found |= 
Found drive G: - CD/DVD. J 


JungleFlasher should display a log similar to the one below. 
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Things not going as expected? — Read the FAQ’s 


Found drive E: - CD/DVD. 

Found drive F: - CD/DVD. <--- Hitachi found 
Found drive G: - CD/DVD. 

Playing 79Unlock Audio CD 

Pausing 79Unlock Audio CD, after 500mS 
Ejecting 79Unlock Audio CD 

Setting bit 3 @ O0x5SBD 

Executing code in Ram 

Done! 


The Drive is now unlocked! 


UNLOCKED - PROCEED! NOW TREAT IT AS PER A 78 — CONTINUE FROM POINT IN 
FLOWCHART YOU WERE AT -CLICK HERE 


Page 67 of 272 


Things not going as expected? — Read the FAQ’s 


V78 / V79 


Now, onto dumping the drive. With the V79 unlocked, or the v78 in ModeB We can now dump 
the drive using RAM Upload method 


Flash 32 | Hitachi GDR3120 L 


oe Ree Se 


32 / 40 
36 Flashing Options Sector List 
Dump Drive © 
46/47 
Manual Spoof © 
58759 
Auto Spoof © 
Flash LT-Plus © 
iair Restore Firmware © 
Set Checksum © 
Free Hash 
Ram Upload © 
n Read to Source | 


So, click Read to Source 
Flashing Options 
Dump Drive @ 
Manual Spoof © 
Auto Spoof © 
Flash LT-Plus © 
Restore Firmware C) 
Set Checksum © 
Free Flash 


Read to Source 
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Things not going as expected? — Read the FAQ’s 


JungleFlasher will now dump the drive using RAM Upload Method 


Found 3 CD/DVD drives. 


Playing 793Unlock Audio CD 

Pausing 79Unlock Audio CD, after 750m5 

Ejecting 79Unlock Audio CD 

Setting bit 3 @ OxSBD 

Executing code in Ram 

Done! 

Dumping f/w of Hitachi 0078/0079 by Ram Upload Method via WINSZ API 


Once it has read the Firmware it will prompt you to save the Firmware. 


Gou TT 


2 


| Name Date modified Type Size Tags 
This folder is empty. 


vorite Links 


Documents 


B® > 
ow 


Desktop 


p 


Recent Places 


Computer 


e 


Pictures 


Music 


More » 


Folders a 


Filename: Hit-OFW Ş 


Once saved, it will open it as Source in FirmwareTool32. 


Vendor Model Rev Firmware Type DVD Key @ 4B00 0x00000000 


Hitachi GDR3120L 0079 Stock D3D22723472F 72364A6A665AE4534534 
OSIG:[HL-DT-STDVD-ROM GDR3120L0079} 


FLASH iX — CLICK HERE TO PROCEED! 
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Things not going as expected? — Read the FAQ’s 


Flashing iXtreme to a stock Hitachi Drive 


Flashing iXtreme to a Hitachi has taken a huge step in development with JungleFlasher’s 
methods. 


JungleFlasher WILL NOT allow you to flash iXtreme over iXtreme, it will detect the checksum 
and detect its hacked by checksum and force restore first. 


Typical error if user tries: 


= 
Flash iXtreme 


a 


Master Checksum is Set, this is normal for a modded drive. 
Restore Drive to Stock first 


So, onto flashing iXtreme 
You will need the JungleFlasher Firmware Pack for this to work. 


With the drive in Mode-B (and Unlocked if a v79) simply select Flash iXtreme from the Flashing 
Options list 
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FimwareTool 32 | DVDKey 32 | MTK Fash 32 | Hitachi GDR3120 
ja uewnaPi@® = PM 
oca ~ E3 i FA [HL-DT-STDVD-ROM GDR3120L0079] 
Use Port 1O 
Vendor: HL-DT-ST L ENE { Refresh | [ Scan | [ Query | [ USmodes | 
Name: DVD-ROM GDR3120L 32/40© 
ne Flashing Options Sector List 
FW Rev: 0079 “ ive © 
i ee Dump Drive € Calculated at 
Reserved: OBMAB 06/05/25 Manual Spoof © A 
58/596 a 
Auto Spoof © 
Send Mode-B 78/79@ i 
Flash LT-Plus © 
[Oren] (L Cose) Transfer Method TE 
Classic z 
79 Unlock pg Set Checksum (~ 
automatic (V Mode Select 
Insert the 79 Unlock Audio CD. { Free Hash 
Ram Upload @) 
Play 79 Unlock Flash LT-Plus 
v | [m] aia 
Found drive E: - CD/DVD. a 


Found drive F: - CD/DVD. <--- Hitachi found 
Found drive G: - CD/DVD. 

Playing 79Unlock Audio CD 

Pausing 79Unlock Audio CD, after 500mS 
Ejecting 79Unlock Audio CD 

Setting bit 3 @ 0xSBD 

Executing code in Ram 

Done! 


4 ham) 


Then, click Flash LT Plus 


Flashing Options Sector List 


Calculated at 


Done! 
Flashing Hacked f/w to Hitachi 0078/0079 by Ram Upload Method via WIN3Z API 


Page 71 of 272 


Things not going as expected? — Read the FAQ’s 


JungleFlasher will seemingly take control, don’t worry, this is normal. 


If you view the log, you see that JungleFlasher has automatically loaded iXtreme LT-Plus 1.1, 
copied all your data (key sector 90004000 isn’t touched) into iXtreme, and flashed a test sector 
for stability. 


The stability test should return as stable, if so, you will see this message. 


. 
Flash ID Strings 


> ) Flashing stabilty test reports stable. 


Do you wish to Continue ? 


If you wish to proceed, click Yes 


Again, JungleFlasher will take over and you will see it flashing the sectors like below: 


Repairing Test Sector. 
Flashing Sector 9003F000 
Done ! 

Flashing Sector 9003E000 
Flashing Sector 90003000 
Flashing Sector 930006000 
Flashing Sector 90004000 


1 
Read back & compare completed, Flashing Stable! 


Once finished, JungleFlasher will verify the firmware written to the drive and report back 
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Things not going as expected? — Read the FAQ’s 


ipee. Hacked f/w to Hitachi 0058/0059 by Ram Upload Method via WIN32 API 
UnLocked! 

Dumping Flash:.......ceeee cece ccc eceeececceces 
Drive is rev 0059 

Loading firmware from buffer 

Inquiry string found 

Identify string found 

Drive key @ 0x4F00 14B34C0258B0AB2B2AB9DC 3B0CB62D02 
Firmware Osig: [HL-DT-STDVD-ROM GDR3120L0059] 
Firmware is: Stock 

Key database updated 


Drive is Stock, rev 0059 

Auto-Loading firmware file F:\JFBeta\Firmware\LTPlus-59-1.1.bin 
MD5 hash: e7c86ba77cd6F78295d4d037cc32df5F 

— string found 

Identify string found 

Drive key @ 0x4F00 000000000000000000000000000 

Firmware Osig: [HL-DT-STDVD-ROM GDR3120L0059] 

Firmware is: LT-Plus 1.1 

11 Sector Differences Found 


Flashing Sector 9003F000 

Done ! 

Flashing Sector 9003E000 

Flashing Sector 90003000 

Flashing Sector 90005000 

Flashing Sector 90006000 

Flashing Sector 9000A000 

Flashing Sector 9001c000 

Flashing Sector 90027000 

Flashing Sector 9002E000 

Flashing Sector 90033000 

Flashing Sector 90034000 

Flashing Sector 90035000 

Done ! 

write verify test.. 

PUTIN Class. a 3c Saewem ee cee nen ones 
Read back & compare completed, write Verified! 
Flash Complete ! 


Power Off — Disconnect drive, connect SATA back to console and test! 


YOU ARE FINISHED — RETURN TO START OF TUTORIAL 


Page 73 of 272 


Things not going as expected? — Read the FAQ’s 


Restoring from Hacked Firmware 


As the title suggests, it is simply a reversal of flashing the Drive with Hacked Firmware. This also 
applies to Hitachi Drives Spoofed as other Drive types / Revisions. 


Again, JungleFlasher will depend on the JungleFlasher Firmware Pack being in the same 


With the Drive in Mode-B (and unlocked if it’s a v79) simply select Restore Firmware from the 


directory as JungleFlasher.exe 


Flashing Options list 


FimwareTool 32 | DVDKey 32 | MTK Fash 32 


Port Properties 
CDAD 


Vendor: HL-DT-ST 
Name: DVD-ROM GDR3120L 
Fiw Rev: 0079 


Reserved: OBMAB 06/05/25 


Send Mode-B 


| Open | | Close 
79 Unlock 
automatic [V] 
Insert the 79 Unlock Audio CD. 


Use Win API @ 
Port 10 


Use | 


Drive Revision 
32 / 40 © 


HC 
46 / 47 
58 / 59 © 


78/79@ 


Transfer Method 


Ram Upload @ 


Ram Poke 


Hitachi GDR3120 | 


Drive 


F:\ [HL-DT-STDVD-ROM GDR3120L0079] 


[ Retesh ] ( Soan ] ( Quey } [Usmoded ] 


Flashing Options 


Dump Drive © 
Manual Spoof © 
Auto Spoof © 
Flash LT-Plus © 


Set Checksum © 


Free Flash 


Sector List 


v 


Calculated at 


Found drive E: - CD/DVD. 
Found drive F: 

Found drive G: - CD/DVD. 
Playing 79Unlock Audio CD 
Pausing 79Unlock Audio CD, 
Ejecting 79Unlock Audio CD 
Setting bit 3 @ O0xSBD 
Executing code in Ram 
Done! 


Things not going as expected? — Read the FAQ’s 


- CD/DVD. <--- Hitachi found 


after 500mSs 


Then, click Restore to Stock 
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4 aa] 


Flashing Options 
Dump Drive | 
Manual Spoof í 
Auto Spoof € 
Flash LT-Plus € 


Restore Firmware @ 


JungleFlasher will dump the Hacked Firmware from the drive, check key location and compare 
to the corresponding Original Firmware in the Firmware Pack 


JungleFlasher will take control throughout this. 


Found 3 CD/DVD drives. 


|> 


Playing 79Unlock Audio CD 

Pausing 79Unlock Audio CD, after 750m5 

Ejecting 79Unlock Audio CD 

Setting bit 3 @ OxSBD 

Executing code in Ram 

Done! 

Restoring Stock f/w to Hitachi 0078/0079 by Ram Upload Method via WINS3Z API 


<| 


After it has dumped and compared the firmware, it will flash a test sector. If this flashes ok, it 


will report it has passed the Stability Test 


It should show as below 
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Things not going as expected? — Read the FAQ’s 


È Flashing stabilty test reports stable. 


Do you wish to Continue ? 


Click Yes to proceed 


Again, JungleFlasher will take control and flash the sectors required 


It will then check the checksum and prompt you to fix the Checksum. 


à Master Checksum is still Set, this is normal for a modded drive. 
B However Checksum should be set for a full restore! 


Clicking Ok will fix Checksum for you 


Check Log for confirmation 


Setting Checksum! 

Calculated Checksum O0x671788B9 
Actual Checksum 0x00000000 
Flashing Sector 3003E000 


Read back & compare completed, Write Verified! 
Flash Checksum Complete ! 


PROCEED TO FLASH iX FW 
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Things not going as expected? — Read the FAQ’s 


Spoofing a Hitachi Drive to report as a Different Drive Revision / Version 
NOTE _ SPOOFING DRIVES IS NOT ADVISED FOR XBOX LIVE USE 


If you wish to flash a Hitachi Drive using JungleFlasher and change the Drive String ID, you 
should follow the procedure of: 


1. Restore to Stock if necessary 


2. Flash iXtreme to the Drive 


3. Auto Spoofing OR Manual Spoofing 


WARNING — YOU MUST 


Flash iXtreme to the drive first before Auto/manual Spoofing 


Manual Spoofing 


As usual you will need to first get the Drive into Mode-B (v79 unlocked) and assigned a drive 
letter (VIA / No Drivers, utilize PortlO) 


The drive should, as above, be flashed with iXtreme to start 
Open JungleFlasher and proceed to the Hitachi GDR3120L tab 


Ensure correct Drive Revision is selected; choose chosen transfer method (Pre78 use Mode 
Select or RAM Upload, v78/79 users can only use RAM Upload) 


Then, select Manual Spoof radio button, Then press Manual Spoof Button 
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Things not going as expected? — Read the FAQ’s 


|_FimwareTool 32 | DVDKey 32_| MTK Fash32 | Hitachi GDR3120 


ania Use Win API @ Dive 
OxA000 v aera MA [HL-DT-STDVD-ROM GDR3120L0059] e 
Use ro U 
Vendor: PBDS Drive Revision | Refresh | | Sean | Query | USmodeB 
Name: VAD6038-64930C 32/40 © : 
PE Sector List 
FW Rev: wc Dump Drive a ee 
Calculated at 
Reserved: A 6/47€ Manual Spoof @ Run time..... 
58/596 Pee : 
Send Mode-B | 78/79€ Ses 
l Open | | Close | Transfer Method Restore Fimware 
Classic 
79 Unlock g Set Checksum £ 
automatic [v] Mode Select ( 
Insert the 79 Unlock Audio CD. È Free Flash 
Ram Upload @ 
= [ 79 Unlock] Ram Poke Manual Spoof 
Flashing Sector 9002E000 a 


Flashing Sector 90033000 
Flashing Sector 90034000 
Flashing Sector 90035000 
Done ! 

Write verify test.. 


Read back & compare completed, Write Verified! 
Flash Complete ! 


You will then be presented with the screen below, 


You can alter the drive key by manually typing it/pasting it/loading a saved key.bin 


(Key.bin can be saved by loading donor drives firmware in FirmwareTool32 as Source and Clicking Save Drive Key.) 


You can Change the OSIG (ID String) by selecting the desired drive from the drop down list, 


And IF you have selected a LiteOn drive from OSIG list then you are able to enter the liteon 
Barcode details by either: 


1. If you have the Inquiry.bin from the Donor Lite-On, you can load it through Load bin 
file button and navigating to the file and opening it. 


2. If you have the Donor Lite-On Drive to hand, you can manually type the 
Alphanumeric code on the top of the Drive like shown below 


When you have selected ALL the sections you require to be changed, press the OK Button 
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Things not going as expected? — Read the FAQ’s 


Drive Key 


Load key.bin F8F6D0A9C4 9AC7CD765F96092E6118E4 Check 


Lite-On Barcode 


AAR 


Load bin file 07010F0 AOAL 


OSIG: 
Current: HL-DT-STDVD-ROM GDR3120L0059 
Spoofed As: 


JungleFlasher will then read, compare and carry out a test flash and ask if you wish to 
continue! Select YES, Manual spoofing will be carried out! 


FimwareTool 32 | DVDKey 32 | MTK Fash 32_|_ Hitachi GDR3120 | 


_— | ] Dave. Serial User Guide 
Save Drive 
Vendor Model Rev Firmware Type DVD Key e Key 
s Open Source 
OSIG: Fi 
[V] Advanced View 
“= A EOE Open Target 
Target |in = @ Flashing stabilty test reports stable. Fi 
: Do you wish to Continue ? 
Manual 
Vendor Model Rev 
Hitachi GDR3120L 0059 
OSIG:[HL-DT-STDVD-ROM GÅ Save to File 


1 Sector Differences Found 
Flash Stability Test 
Flashing Sector 9003F000 


Read back & compare, complete, Flashing Stable! 

Repairing Test Sector. 

Flashing Sector $003F000 

Done ! | 


The example below is a Hitachi — manually spoofed to show as a BenQ! 
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Things not going as expected? — Read the FAQ’s 


| FamwareToot 32 | DVOKey32_| MTK Aash 32 | HtachiGDR3120 | 


[i 4 ee 1 
Vendor Model Rev Firmware Type DVD Key @ y 
Open Source 
OSIG: Firmware 
[V] Advanced View Spoof Source to Target (Donate... 
p m 
Target | inquiry | identify | Drive Senal | Open Target 
Bacia Firmware 
Manual 
Vendor Model Rev Firmware Type DVD Key @ 4F00 000000000 Spoofing 
Hitachi GDR3120L 0059 iXtreme:1.51:v59S-12x FE8FEDOASC4SAC7TCD765F96092E6118E4 
OSIG:[HL-DT-STDVD-ROM GDR3120L0058} Spoofed As: [PBDS VAD6038-64930C ] Save to File 


Repairing Test Sector. 
Flashing Sector S003F000 
Done ! 

Flashing Sector 9003D000 
Done ! 

Write verify test.. 


Read back & compare completed, Write Verified! 
Flash Complete ! 


Power Off — Disconnect drive, connect SATA back to console and test! 


Job Done © 


YOU ARE FINISHED — CLICK HERE TO RETURN TO START OF TUTORIAL 
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Things not going as expected? — Read the FAQ’s 


Auto Spoofing a Hitachi 


As with all Hitachi Tasks, you must set Mode-B (and unlocked if v79) first, have a drive letter 
assigned if using Win API, or, PortlO for VIA / No Drivers. 


Ensure Drive is flashed with iXtreme prior to spoofing! 


Proceed to the Firmwaretool 32 tab 
Click Open Source Firmware button, load the Dumped firmware file from the donor drive. 


In this example from a BenQ drive! 


FimwareTool 32 | DVDKey 32 | MTK Fash 32 | Hitachi GDR3120 


Source | inquiry | Identify | Drive Serial 
° | User Guide 
C:\BENG-OFW bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 Key 
Beng VAD6038 64930C Stock A858D16A78F40CEFSE016C83F8E2C80A 
; Open Source 
OSIG:[PBDS VAD6038-64930C ] Fi 
V| Advanced View Spoof Source to Target Donate...) 
i i z Open Target 
Target | inquiry | Identify | Drive Serial | p 
Manua 
Vendor Model Rev Firmware Type DVD Key @ Spoofing 
OSIG: Save to File 


> 


Loading firmware file C:\BENQ-OFW.bin 

MDS hash: 79f¢bacS19éd6f£425f0cbc3beead2b75 

Inquiry string found 

Identify string found 

Drive key @ 0xA030 A858D16A78F40CEF9E016C83F8E2C80A 
Firmware Osig: [PBDS VAD6038-64930C ] 
Firmware is: Stock 


a) 
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Things not going as expected? — Read the FAQ’s 


Now select the Hitachi GDR3120 tab, select the Auto Spoof radio button. Then press Auto 
Spoof button 


om Use Win API © Drive 
joie = Use Pot 10 PA [HL-DT-STOVO-ROM GDR3120L0059) - 
se rof hl 
Vendor: HL-DT-ST 
reve ce [ Refresh | {Scan | [ Query | [ USmodes | 
Name: DVD-ROM GDR3120L 32/40 
FMR 0059 se = 
pa ee 46 / 47 oe: Calculated at 
A we: 9 06/01/24 Manual Spoof | Run time..... 
58/596 
Auto Spoof © 
| Send Mode-B 78/79 
Flash iXtreme | 
l Open ) f Gose Transfer Method z a 
Unlock Classic 
ias E Set Checksum 
automatic [| Mode Sel 
Insert the 79 Unlock Audio CD. Free Flash 
Ram Upload © 
| 
Ram Poke 


Flash Complete ! 

Leading firmware file C:\Users\Andy\Downloads\ €4930c\SENQ-OFW. bin 
MDS hash: dS8bSef7d4fe9b4E83ac072c09504b4z9 

Inquiry string found 

Identify string found 

Drive key @ OxE03S0 FSFEDOASC4SACTCDTESFSSOSZEGI ICES 

Firmware Osig: [(PBDS VADG038-64930C } 

Firmware is: Stock 


Jungleflasher will then test flash a sector for stability check and ask for confirmation to 
proceed! Select YES! 


Flash ID Strings c] 


(?) Flashing stabilty test reports stable. 


Do you wish to Continue ? 


Jungleflasher will then proceed to read, compare and write to drive — Firmwaretool 32 tab will 
automatically open to show you the source (the drives previous firmware) and the target (the 
Firmware that is now on your drive — including the spoof information) 
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Things not going as expected? — Read the FAQ’s 


| FamwareTool 32 | DVDKey 32 | MTK Rash 32 | Htachi GDR3120 | 


| Source | Inquiy | identity | Drive Seria 


User Guide 
CA\BENQ-OFW bin 

Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 Key | 
Benq VAD6033 64930C Stock A858D16A78F40CEF9E016C83F8E2C80A 

Open Source 
OSIG:[PBDS VAD6033-64930C ] Fimware 


Birner ven [ Spool Source to Target | | Donate... 


| Target | inquiry | Identify | Drive Sera | 


Ei 


Vendor Model Rev Firmware Type DVD Key @ 4F00 0x00000000 
Hitachi GDR3120L 0059 iXtreme:1.51:v59S-12x FSFEDOASC4SAC7CD765F96092E6118E4 


OSIG;[HL-DT-STDVD-ROM GDR3120L0059}] Spoofed As: [PBDS VAD6038-64930C ]} Save to File 


| 


Repairing Test Sector. a 
Flashing Sector 9003F000 

Done ! 

Flashing Sector 90030000 

Done ! 

Write verify test.. 


Read back & compare completed, Write Verified! 
Flash Complete ! 


Power Off — Disconnect drive, connect SATA back to console and test! 


Finished! © 


YOU ARE FINISHED — CLICK HERE TO RETURN TO START OF TUTORIAL 
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Things not going as expected? — Read the FAQ’s 


LiteOn (Phats and Slims) 


Currently in circulation there are several distinct versions of LiteOn drive. These 
can be split into 2 Categories: 


Phats: Firmware versions 74850C , 83850C , 83850C v2, 93450C, 02510C 


These all had differing methods of obtaining the drive keys (which have been kept 
in the tutorial for completeness) however a new method “Pogo Mo Thoin” (PMT) 
has been released and can be used to obtain all the required info from ALL these 

drives. 


The only drive that you shouldn’t need to use the PMT method for is the 83850C 
v1 with stock Firmware(as this can be done without opening the drive case! — the 
easier the better! Right?) 


NOTE: AFTER DASHBOARD UPDATE (13146) ALL PHAT LITEONS ARE NOW STOCK 02510 FW 
NOTE: ALL PHAT LITEON POST DASH UPDATE WILL REQUIRE PMT/PROBE 3 or MRA 


IF YOU HAVE A STOCK 83850 v1 YOU CAN DUMP DUMMY.BIN BEFORE UPDATE, THEN 
UPDATE. MANUAL LOAD LT+1.91 AND SPOOF. THIS WILL AVOID OPENING YOUR DRIVE. 


The other remaining drives are the 
Slims: Firmware Versions 9504, 0272 , 0225 , 0401 , 1071 


Currently Only the LiteOn Slim Drive with 9504/0272 (pre 13599 dashboard) can 
be written to (unless you have a unlocked 0225/0401 — Rare!) The Drives with 
Firmware Version 0272 (if you have dashboard 13599) 0225, 0401 and 1071 can 
ONLY have their Keys Read unless they have been modified or unlocked 


NOTE: AFTER DASHBOARD UPDATE (13146) ALL SLIM 9504 LITEONS ARE NOW STOCK 0272 FW - 
AFTER DASHBOARD UPDATE (13599) 0272 ARE NOW LOCKED! 


PROCEED 
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Things not going as expected? — Read the FAQ’s 


Possibly Stock 
83850C v1? 


CLICK HERE 


If this fails return 
here and use 


i PMT Method 


CLICK HERE 


LAT nasi 
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Things not going as expected? — Read the FAQ’s 
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Things not going as expected? — Read the FAQ’s 


Lite-On PLDS DG-16D2S(-09C) — Legacy Methods 


Firmware versions 74850C , 83850C , 83850C v2, 93450C 


Overview 


With the release of the 83850C firmware , LiteOn drives required two totally different methods. 
With the release of the 83850C v2 and the 93450C there was no known way to extract the key. 
However there is now a method to dump the whole FW from any of these LiteOn drives! (which 
is the ONLY method to get the key from the 83850C v2 & the 93450C) Although MRA method 
works on all (current) LiteOn's - DVDKey32 / LO83Info will always remain the simpler method to 
obtain info from earlier drives. 


The 74850C requires additional hardware (it requires the utilization of a RS232 to TTL serial 
hardware, or a popular variant such as Xecuter CK3 Pro or Xecuter CK3 Lite with the Xecuter 
Probe (v1 or v2) or Maximus USBXtractor & powerunit or Maximus Xtractor (with optional 
spear) to obtain the drive specific data (key/inquiry/identify/Serial) which once extracted are 

used to create the dummy.bin 


Whereas the 83850C v1 does NOT require additional hardware and can be dumped/flashed 
using only a SATA connection 


The key/inquiry/identify/serial files are merged into a dummy.bin (this allows for easy 
manipulation of the drive info for placing into the iXtreme firmware). They contain information 
that is required for proper identification and security related issues. 


The 83850C v2 was quickly released to combat key retrieval by the earlier methods so key 
retrieval using 83850C v1 or original method was no longer an option! This change occurred 
around July/Aug 09 drive manufacture dates. There is no outward difference between the 
83850C v1 and the 83850C v2 — the only way to discover which you have is to try the 83850C v1 
method! If successful you have the version 1 — IF NOT Jungleflasher will tell you, you have an 
83850C v2 and Lo83 function is ONLY for v1. 


The 93450C quickly followed — Once again key retrieval was not an option with simple SATA 
commands or probe used for 74850C 


Now available, is a method to dump the whole firmware from ALL current LiteOn Drives — The 
MRA Hack method is a little more complex than previous methods and requires some soldering 
skills and cutting and reconnection of traces on the PCB! However there are now some other 
options available — the best of these are described in this tutorial. 
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Things not going as expected? — Read the FAQ’s 


WITH THIS IN MIND — IT SHOULD ONLY BE ATTEMPTED BY 
SOMEONE WITH SOME PREVIOUS SKILL OF WORKING WITH 
ELECTRONICS / SOLDERING 


It is recommended to use the original (Simpler) methods for the 74850C and the 83850C v1. 
The FULL firmware dump can be performed on these drives — BUT it is a lot easier and less likely 
to go wrong if using the earlier methods described in this tutorial. 


Here are some examples of those people without skill enough for the job! 


- + os po ni aed j 
an {ff 16-100 a RER i 
i „pi 


* 


Xecuter LT Switch . . 


~~ 


-m 


If you are going to produce results like these — Don’t expect any sympathy! 


And - expect to pay to have a professional fix it for you! 


YOU HAVE BEEN WARNED! 
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IF you have previously flashed this drive and think you have its details in the Key Database — 
Consider this option! No need to re-dump or MRA the drive? 


— CLICK HERE — DVD Key: Verified f 


Otherwise continue through the flowchart 


83850C V2 or 93450C 
(Pre-flashed with ix1.61- CLICK HERE ) 
83850C STOCK Firmware OR iX LT - CLICK HERE 


(SATA only) (Additional skills and some modification 
See Note 2 req'd) 


74850C 
(Requires extra HW if stock) 
See Note 2 


Stock Firmware? > 
Pre-iX LT, continue down chart! — 


| 
l I 
! I 
\ If LT See Notes 1&2 \ 
I I 
l I 
l I 
i 1 


Iri 83850C, tried it but J 
CLICK HERE it’s a V2? 
LOW LINK ABOVE! 


1. If your Drive has been previously flashed with iXtreme LT — then you will no longer be 
able to use 74850C or 83850C v1 or ‘Dummy-from-iXtreme’ methods to retrieve 
Dummy.bin! A full dump can still be performed using MRA method CLICK HERE 


2. During Flashing process — IF your drive has been flashed before (i.e. NOT a VIRGIN 
DRIVE) OR you have not used MRA hack to get a FULL OFW, then you are going to get a 


i a ee re Nie a “hee 


statement like this: === es This is normal for a PRE-FLASHED 
drives or you have used a Dummy.bin — Ignore it! 


If you wish to include this info from a 74850C or 83850C v1 VIRGIN drive — you must do 
a full dump using MRA style method - CLICK HERE 
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LiteOn “HALF TRAY OPEN” method! 


To obtain the key and other drive specific info from LiteOn drives the user must be familiar with 
the correct method to set “Half Tray Open” — this is especially important when doing 83850C 
fw’d drives as the drive must be set into this position twice during the extract! 


Using xbox360 to power the drive 
If using a 360 to power the drive this method can be tricky to accomplish. 


You need to power on the drive with Eject status closed but Tray Half Open — To do this using 
an Xbox 360 as Power source, eject the DVD drive, then, press eject to ‘close’ the tray. Now this 
is the important part — you MUST remove the DVD power plug (the black cable with white 
plug on back of DVD-ROM) from the DVD Drive BEFORE it closes fully. 


Wait for a few seconds and replace the power plug into the DVD drive taking extreme caution 
to plug the plug the right way around — once done, the drive is now powered, console thinks its 
closed but it is in fact half open. 


Using a Connectivity Kit / Xtractor / power dongle to power the drive 
For this method, we still need to power on the drive with the “half open tray”. 


You need to power on the drive with Eject status closed but Tray Half Open — To do this using a 
connectivity kit/power unit/Xtractor as Power source, eject the DVD drive, then, press eject to 
‘close’ the tray. Now this is the important part — you MUST switch off the kit BEFORE it closes 

fully. 


Wait for a few seconds and switch the connect kit on again — drive is now at “half open tray” 


(NOTE- if using Maximus power unit — you must hold in the eject switch till fully open then 
release to close — as it closes switch off, then switch back on!) 


Manually 


The easiest way to do this is to use manual eject before powering the drive, to manual eject 
simply push this slider along until the tray is released. 
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Then, pull the tray out fully and push half way back in. Now, hook it up to the PC using 
Connectivity Kit and SATA then power on. (If powering with Xbox — then DVD power plug must 
be removed before this process, with Xbox powered on — then power plug connected after tray 

position is set!) 


Now, with the eject status set, Open JungleFlasher 


RETURN TO FLOWCHART AND CONTINUE — CLICK HERE 
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If you have LiteOn files from previous extractions/methods 


Jungleflasher — maintains backwards compatibility with files that have been extracted from 
earlier methods! 


A FRESH extraction is recommended where possible — but the option remains 


available 
For 74850C Files (Key. bin/Inquiry.bin/Identify.bin) — Read On! 


For 83850C File (unique.bin.key) — Click Here! 


For 74850C firmware files (Key.bin/Inquiry.bin/Identify.bin) simply go to DVDKey32 tab, 


|_FimwareTool 32 | DVDKey 32 | MTKAlash 32 | HitachiGDR3120 | IRC Channel | 


And press the DummyGen button — this will allow you to load each file into Jungleflasher which 
then creates a Dummy.bin and loads it as source. Ready for spoofing to target file and then to 
proceed onwards to erasing and writing! 


PhatKey | | SlimKey | | LO83info | 
a 


| Dummy from KeyDB | | Dummyfrom iXtreme | 


CLICK TO PROCEED TO FIRMWARE MANIPULATION 


For 83850C v1 firmware files (unique.bin.key) 
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Note: If you wish to include calibration data from the 83850C v1 (VIRGIN drives ONLY) 
— you must do a full dump using MRA style method - CLICK HERE — if you are not bothered, 
continue! 


Go to DVDKey32 tab 


| FimwareTool 32 | DVDKey 32] MTKAlash 32 | HitachiGDR3120 | IRC Channel 


Then press the Import83.key button 


PhatKey SlimKey LO83info 
Dummy from KeyDB Dummy from iXtreme 


this will allow you to load the file into Jungleflasher which then creates a Dummy.bin and loads 
it as source. Ready for spoofing to target file and then to proceed onwards to erasing and 
writing! 


CLICK TO PROCEED TO FIRMWARE MANIPULATION 
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Obtaining Key/Inquiry/Identify and Dummy.bin from iXtreme flashed 


Lite-On Drives (DOES NOT WORK ON iXtreme LT) 


LiteOn drives of either FW version that have already been flashed with iXtreme can be easily 
dumped using only SATA connection (no requirement for probe or TTL convertor) this is a 
function of the iXtreme firmware NOT a workaround for dumping stock drives! 


For this method, we still need to power on the drive with the “half open tray”. 
FOR INSTRUCTIONS ON HALF OPEN TRAY — CLICK HERE 


Now, with the eject status set, Open JungleFlasher, you will be presented with the Welcome 
Screen. After a few seconds the main window will load. 


Now, click the DVDKey32 Tab 


FimwareTool 32 | DVDKey 32 | MTKAlash 32 | HitachiGDR3120 | IRC Channel 


Select Correct I/O port (check for drive properties in the Drive Properties section) it should 
report as PLDS DG-16D2S (unless spoofed), you can choose to dump dummy.bin only as 
opposed to all 5 files (Key, Inquiry, Identify, Serial and dummy.bin) as dummy.bin contains all 
the information of the other 4 files. 
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FimwareTool 32 | DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


1/0 Port VIA ports Only [E Com Port USB Xtractor Switch 
| œao00 [..] | Include nonIDE Ports [V7 coM7 ~ (m Dummy bin Only [v7 
Port Properties Com Port Properties 
VO Address: OxA000 Port:  COM7 
Type: SATA Type: Xecuter CK3 Pro (Rev D) 
Channel: Primary Name: Prolific USB-to-Serial Comm Port 
Postion: Master Status: Ready 
Device: Standard Dual Channel PCI IDE : 
Controller = 


PLDS 


Status: 
DG-16D2S PhatKey SlimKey LO83info 


7485 DVDKey32 DummyGen 83 key file 
OCA0A1D608CG82081402 


Not Found 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 14:51:46 2010 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32-.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 2 Com Ports. 

Drive is Lite-On.. 


Then, simply click Dummy from iXtreme. 


Save as prompted, 


Filename: Dummy.bin X 


Save as ype (Fimme mga in 


5 Hide Fides 


CONTINUE WITH FIRMWARE SPOOF — CLICK HERE 
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Extracting Key and drive info from 74850C LiteOn 


Note: If you wish to include calibration data from the 74850C (VIRGIN drives ONLY) — 


you must do a full dump using MRA style method - CLICK HERE — if you are not bothered, 
continue! 


You need to power on the drive with Eject status closed but “Tray Half Open” — 
FOR INSTRUCTIONS ON HALF OPEN TRAY — CLICK HERE 
With the correct tray status 
Open JungleFlasher, 


As you are using DVDKey 32 to obtain data, select DVDKey32 Tab 


|_FimwareTool 32 | DVDKey 32 | MTKAlash 32_| HitachiGDR3120 | IRC Channel | 


Check Drive Properties for PLDS DG-16D2S. 


Select Correct I/O port (check for drive properties in the Drive Properties section) 


1/0 Port VIA ports Only E 
Include non-IDE Ports (V 

Port Properties 

VO Address: OxA000 

Type: SATA 

Channel: Primary 

Postion: Master 

Device: Standard Dual Channel PCI IDE 

Controller 


PLDS 
DG-16D2S 


Fiw Rev: 7485 
Reserved: OCA0A1D608CG82081402 
DVD Key: Not Found 


Select COM port (relavant to your setup — shown in table below), 
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optionally, choose to dump dummy.bin only (shown in red)as opposed to all 5 files (Key, 
Inquiry, Identify, Serial and dummy.bin). 


USB Xtractor Switch 
Dummy bin Only [V 


USB Xtractor user should enable Additional Functions check box (shown in blue) 


Additional functions 


Dummy bin Only [v] 


Right-click on DVDKey32 button for time delay settings if you require a little settling time to 
ensure probe is correct position before Jungleflasher attempts to read the key (time after 
button press before key read starts) 


NNN 


then insert probe / spear into R707 via (as per table below), 
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PROBE VARIATIONS AND LED INDICATION AS FOLLOWS 


CHECKED / SELECTED THIS 
Com Port USB Xtractor Switch 


COM7 Dummy bin Only [V] 


~& 


Com Port Properties 
Port: COM? 


Xecuter CK3 Pro (Rev D) 
Prolific USB-to-Serial Comm Port 
Ready 


Type: 
Name: 


Status: 


Using USB cable to connect (can also use 
serial) 


Com Port USB Xtractor Switch 


Dummy bin Only |v 


COM7 


~& 


Com Port Properties 
Port: COM7 


Xecuter CK3 Pro (Rev D) 
Prolific USB-to-Serial Comm Port 
Ready 


Type: 
Name: 


Status: 


Using USB cable to connect (can also use 
serial) 


WHAT YOU SHOULD SEE 


BLUE POWER LED 
LIT 


GREEN LED LIT 


(once probe 
touches R707 to 
indicate a good 
circuit/connection) 


XECUTER PROBE 2 (in PROBE v1 MODE) 


Mode switch to 
PROBE, 


BLUE POWER LED 
LIT (power 
supplied to probe) 


CONENCTION LED 
LIT - (indicates 
good connection 
to R707 circuit) 


STANDBY LED 
EXTINGUISHED 
(safety circuit 
disengaged) 
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Com Port 


= 
Com Port Properties 
Port: COM8 
Type: 360 Xtractor 
Name: USB Serial Port 
Status: Ready 


GREEN POWER 


LED LIT 


CONNECTION LED 
LIT (when probing 
R707 to indicate 
good connection 


Using USB Cable to connect (can also /circuit) 
; MAXIMUS SPEAR 
use serial) 
Com Port 
OM3 -| (ices) 
Com Port Properties BLUE LED 
Port: COM3 
SHOWING when in 
Type: USB Xtractor contact with R707 
Name: USB Serial Port and ready to read 
Status: Ready USBXtractor 
USB ONLY 
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FimwareTool 32 | DVDKey32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel 


WO Port VIA ports Only [ Com Port USB Xtractor Switch 
A000 ~ (©) include non-DE Ports [¥] COM7 -B Dummy bin Only 
Port Properties Com Port Properties 
VO Address: OxA000 Port: COM7 
Type: SATA Type: Xecuter CK3 Pro (Rev D) 
Channel: Primary Name: Prolific USB-to-Serial Comm Port 
Postion: Master Status: Ready 
Device: Standard Dual Channel PCI IDE Dri 
Controller "a 
Key: 
Drive Properties Status: 
Vendor: PLDS 
Name: DG-16D2S [ PhatKey | |  SlimKey | | LO83info | 
der es C [Sams | (skate 
Reserved: OCA0A1D608CG82081402 
DVD Key: Not Found [Dummy from KeyDB | | Dummy rom iXtreme | 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 14:51:46 2010 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 2 Com Ports. 

Drive is Lite-On.. 


Providing serial connection was good, DVDKey 32 will dump the key, then will test the key 
against the drive for 100% Verification that it is the correct key! 


DVDkey delayed by 5 seconds 


Sending DVDKey request to I/O port 0xA000 and COM7 
se Gavia eee oie ere meas Serial Data looks ok, key returned: S9B749SDEBF3935822COSSOFB44B2D148B 


Extracted drive key passed Verification ! 


Quickly followed by a lot of actual dumped information from drive, 


then prompt you to save key.bin, inquiry.bin, identify.bin, serial.bin (unless you have selected 
dummy.bin only box) and dummy.bin. 


Of course, should you have enabled the ‘Dummy.bin Only’ option you will only be prompted 
to save Dummy.bin. 
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m « JungleFlasher v0.1.74 Bet... » New folder v | #¢ || Search New folder 
ech St des ay | hessas é 


ES 


Organize v New folder 


> [5] Documents “« Name Date modified 
> 6) Downloads 
ò P Music No items match your search. 


> [E] Pictures 
> BB Videos 


> &@ Homegroup 


sa Computer 
» la Win 7686) (C) 
> æ DATA (D:) 
> æ Local Disk (E:) 
> ej Backup (H:) 
b Wir 7064) E) > (IT eee] ' 


File name: Dummy.bin x 


Save as type: 


ia Hide Folders 


There is now No Requirement to dump the key multiple times! 
Nor is there a requirement to test it in a spare drive! 


The key is dumped then Verified against the drive itself! Using c4eva’s 
extremely clever verification routine, Jungleflasher tests the key 
against the drive (much like the xbox itself does!) 


There is a 1 in 3.4025 x 10438 chance of guessing the right key — so the 
fact it verifies means it’s correct! © 
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Firmware Manipulation 


JungleFlasher will then prompt you asking if you would like to auto-load iXtreme for Lite-On 
Drives. You must have installed the JungleFlasher Firmware Pack into the same directory as 
JungleFlasher.exe if you wish to benefit from this feature. 


E 


Loading Source 


~ Lite-On firmware loaded to Source buffer! 
ty Do you wish to auto-load Lite-On iXtreme ? 


Love) [te 


Click Yes to auto load iXtreme (from the firmware pack) for Lite-On into the 
Target Buffer, JungleFlasher will also load your previously dumped Dummy.bin as 
Source Firmware. Then, copy data from source to target automatically. 


Just verify Source data reports as it should, DVDKey 32 Extract with OSIG of PLDS 
DG-16D2S with the same key you dumped (check log for reference). 


Now, verify unique Source Data matches that in Target Buffer and click save to 
file if you wish to backup your Hacked firmware. 
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FimwareTool32 | DVDKey 32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel | 


User Guide 
C:\JungleFlasher v0.1.74 Beta (138)\New folder\Dummy bin 
vos Host | [owe mm 
Open Source 
Firmware 
Check The Key has been 
pied Open Target 
ed from source to target Fi 


Lite-On DG-16D2S 74850C iXtreme LT 1.1 
OSIG:[PLDS DG-16D2S 7485] 


At this stage, use 
this to save your 


Drive key @ n/a 77777777777777777777777777777777 
Firmware Osig: [PLDS DG-16D2S 7485] 
Firmware is: iXtreme LT 1.1 hacked FW 
Spoofing Target 

DVD Key copied to target 

Target is LT - ID strings not copied to Target 

Serial data copied from Source to Target 

No Calibration data in source 


E 


ba 


(Please note the picture above is an example only! If you have a different firmware versioned 
drive then obviously you will have different numbers appearing — The important part is that Key 
and OSIG matches!) 
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The Next step is to ERASE the drive, its vitally important you 
only do this once you KNOW you are ready and have read the 
tutorial, in full, to understand the risks. 


IMPORTANT! 


Sending the erase command to the Lite-On using VIA Card with drivers installed 
poses the potential risk of the system locking up due to the VIA chipset polling 


Please CLICK HERE and follow instructions to remove Card Drivers if you have 


not done so already. 
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Erasing a Lite-On PLDS DG-16D2S. 


PLEASE READ THE WARNINGS ABOVE. 


Once you erase the drive, there is NO GOING BACK. 


Click the MTKFlash 32 Tab. 


|_FimwareTool 32 | DVDKey 32 | MTKAash 32 | HitachiGDR3120 | IRC Channel | 


Verify I/O Port is correct(for your setup!) and click Lite-On Erase. 


360 Tools 
Beng Sammy Lite-On 
UnLock UnLock Erase 


JungleFlasher will warn of the importance of having a verified Good Drive Key. 


Please Note, the only ways to know 100% that a key is good, is to ensure your drive key was 
Verified by JungleFlasher or flash your firmware to a identical drive first and test it in the 
xbox itself 


Lite-On-Erase 


P j Are you 100% sure you have the Correct Drive Key 


This Command will Completely Erase your Drive f/w! 


Do you Wish to Proceed ? 


Click Yes if you wish to Proceed. 


JungleFlasher will present you with another warning. 


Page 105 of 272 


Things not going as expected? — Read the FAQ’s 


Lite-On-Erase 


| P , When Erase is complete, Vendor Intro will be sent. 
Power drive Off then On in quick succession, Once! 
Drive should return Status 0x72 and a good Device ID. 


Do you Wish to Proceed ? 


Read this carefully, in most cases JungleFlasher wil return a Running Log similar to this: We 
have had 0xDO / 0x80 / OxF2 / 0xD1 and all worked fine. 


After pressing yes and during the sequence of dots shown below, switch drive Power Off then 
On - ONCE. 


As Soon as this line appears! Cycle 
AMC ETI SMPTE aeee 
Reading Bank$32: staan 
Write verified OK ! 


power to drive i.e. 


Switch Power OFF then ON 


Sending Vendor Outro to port OxCFOO 


Sending Lite-On-Erase request to port 0 


Drive returned Status OxDO 


Hopefully you will see good Flash Chip Properties and Status 0x72 (2 known SPi Chips for Lite- 
On’s, Winbond and MXIC) MXIC Shown, drive will appear in Vendor Mode under Drive 
Properties. 
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Fimware Tool 32 MTK Fash 32 | Hitachi GDR3120 


activate.iso 
VO Fort USB Only [©] VIA ports Only E] 360 Tools 
Port z UnLock UnLock Erase 
V/O Address: 0x0000 ZW 
Type: USB 


Vendor ID: OxC2 


Device ID: 0x11 


Device: XECUTER X360USB PRO TE 
(Ver 0.18) ; 


Drive Properties 
Vendor: Drive in Vendor Mode! 


ce flash found with Status 0x72 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxC2 

Device ID: 0x11 

Flash Name: MXIC(MX25L2005) 

Flash Size: 262144 bytes 


Drive is now in Vendor Mode (0x72). 


Click the Write button to write Target Buffer to the drive. 


Flashing Tasks 
Intro / Device ID Outro / ATA Reset 
Phat@) © Slim 


Writing target buffer to flash 

Mriting Bank Bi 2-2-2222 62c5scc5 
Mzitinmg Bank 2s. oc scccccseececec 
Mriting Bank 22 22.252 ccccessces 
Mriting Bank J: oc cccccecceccces 
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‘ 


Flash Verification Test ! 
Reaatinmg Bank fz <esscscsccsccecs 
Ranting Bank 12. oo cscecscceccsus 
Maading Bank 22 --..-2i.-2.--5--.- 
Reming ME 32: 3.52 cso be} 
Write verified OK ! 


Write Verified OK! in Running Log signals good write. 
Now send an Outro to the drive. 


aressing the Outro / ATA Reset Button 


Drive Properties 
Vendor: 


PLDS 
DG-16D2S 


Hitachi GDR3120_ | IRC Channel | 


Name: 


F/W Rev: 0251 
Reserved: OCAQA0D608CG73880800 


Only 360 Tools 


activate.iso 


DVD Key: Verified E 


Different properties when flashing a 
02510C, for example. 


PLDS 
DG-16D2S 
7485 


DE Ports |v Beng Sammy | | Lite-On Slim 
UnLock | | UnLock | | Erase | | UnLock 


OCA0A1D608CG83390701 
DVD Key: Verified E 


Banting Bank Js 2c cce ct acee uid 
Write verified OK ! 


Sending Vendor Outro to port 0x0000 
Drive is Lite-On.. 


‘Key found in KeyDB at record (2 - Firmware) 
Key is: B982393DBFCC1O4ES39F74EASA468745 


Key has been tested and verified, thanks C4eva ! 


This will release a drive from Vendor Mode and send ATA Reset to the Drive. 
inquiry command to the drive. 
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It then sends an 


This will save you power cycling the drive and then changing port away and change it back 
again, with the click of a button, the drive will ‘reset’ itself and JungleFlasher will send an 
inquiry command to the drive. If successfully flashed the drive should Inquire correctly and 
display drive properties. 


Power Off — Disconnect SATA from PC, connect SATA back to console and test! 


COMPLETE — CLICK HERE TO RETURN TO START OF TUTORIAL 
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LiteOn “83850c v1” Extraction 


How to obtain the unique data from your PLDS DG-16D2S 83850c v1 drive and 
create a Dummy.bin. 


The 83850C v1 Firmware drives DO NOT require the additional 
Hardware that the 74850C Firmware drives do — 


83850C v1 drive’s information is extracted through SATA! 


Obtaining Dummy.bin 


Please Note: Dummy.bin is not Original firmware, it is [FAKE] firmware based on 
the structure of an Original firmware file, and this makes everything easier to 
work with. 


Connect your 83850c to your PC via S-ATA 


Power on and run JungleFlasher v0.1.69b or above 


JungleFlasher0.1.74b gł 


For Support join #JungleFlasher on EFnet 


(example only) 
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Select DVDKey32 Tab 


WO Port USB Only [©] VIA ports Only [Œ] Com Port Additional functions [| 
0000 ~ [k] include non-DE Ports [7] ~ E3 Dummy bin Only [7] 
Port Properties Com Port Properties 

VO Address: 0x0000 SP Port: 

Type: USB Type: 

Channel Primary Name 

Postion: Master Status 

Device: XECUTER X360USB PRO 

( Ver 0.18) — 


JungleFlasher 0.1.79 Beta (210) 
Session Started Fri Mar 04 20:08:13 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.18 


Found 11 I/O Ports. 


Check to see the 83850c Inquires on the port. 
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m 


Select LO83info 


(Prater 


[ DVDKey32 | [ DummyGen | [ 83 keyfile | 


If you see this message: 


r 
LO83info 


v ) Drive responds as Lite-On 83 version 2 


LO83info is only for Lite-On 83 version 1 


You have a 83850C v2 so CLICK HERE TO PROCEED 


IF NOT then you have the 83850C v1 and should the image shown below! 
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FimwareTool 32 | DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 
WO Port VIA ports Only Com Port USB tractor Switch 
E800 ~ [k] Include non-IDE Ports [¥] COM7 ~| B Dummy bin Only [7] 
Port Properties Com Port Properties 
I/O Address: OxE800 Port: COM7 
Type: SATA Type: Xecuter CK3 Pro (Rev D) 
Channel: Primary Name: Prolific USB-to-Serial Comm Port 
Postion: Master LO83info 
Device VIA VT6421 RAID Controlle: 
Drive Properties 
Vendor: PLDS 
Name: DG-16D2S 
Fiw Rev: 8385 fl 
file 
Reserved: 0CA0A2D609CG92180800 
DVD Key: Not Found Dummy from Key DB Dummy from iXtreme 
0000: 05 80 00 32 5B 00 00 00 - 50 4C 44 53 20 20 20 20 ...2[...PLDS a 
0010: 44 47 2D 31 36 44 32 53 - 20 20 20 20 20 20 20 20 DG-16D2S 
0020: 38 35 30 35 30 43 2D 32 - 00 00 00 00 00 00 00 00 85050C-2........ 
0030: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ...--.- eee 
0040: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ......._._.L Le 
0050: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 OO .........L LLL F 


Sending LO83info request to I/O 


port 0xE800 


Here you must set the tray to ‘Half Open (but half closed status)’, 


FOR INSTRUCTIONS ON HALF OPEN TRAY — CLICK HERE 


m 


Please ensure you have the drive fresh / power cycled after setting Half Open 
Tray, this is essential. Then, click OK 


JungleFlasher will then send the LO83info command to the drive; you will see the 


following in the Running Log 
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DVDKey 32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel | 


WO Port VIA ports Only Com Port USB Xtractor Switch 
(E800 ~ [...] Include non-DE Ports [7 COM? -| Dummy bin Only [7] 
Port Properties Com Port Properties 

VO Address: OxE800 Port: COM7 

Type: SATA Type: Xecuter CK3 Pro (Rev D) 

Channel: Primary Name: Prolific USB-to-Serial Comm Port 


LO83info 


o 
o 
w 
o 
o 
o 
(= 
o 
o 
o 
o 
o 
o 
o 
o 
(= 
o 
o 
o 
o 
| ie ee E | 
o 
o 
(= 
o 
o 
o 
(= 
o 
o 
o 
o 
o 
o 
(= 
o 
o 


Sending LO83info request to I/O port OxE800 


m 


4 


DO NOT POWER CYCLE THE DRIVE AT THIS STAGE; DOING SO WILL 
RESULT IN A BAD/FAILED DUMP!!!! 


Eject the drive (so it is fully open) OR manually move the tray fully open by hand! 
Once tray is fully ejected, click OK 


If the dump appears to JungleFlasher that it was valid, JungleFlasher will prompt 
you to save, but look for this in the log: (with Your key!) 


Extracted drive key 9B749DEBF3935822COSS0FB44B2D148B 
Extracted drive key Passed Verification ! 
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Jungleflasher will now prompt you to save! 


Save as type: Firmware Images [*.bin} Na J 


Save this file. 


Note: | only save dumm y.bin as | have dummy.bin only enabled in the DVDKey32 Tab, JungleFlasher 
*may* prompt you to save Inquiry.bin, Identify.bin, Serial.bin and Key.bin also, if this isnt enabled. 


Once saved, JungleFlasher will load Dummy.bin as Source Firmware in 
FirmwareTool32 and prompt you to auto load iXtreme (from the firmware pack) 


IF YOU INTEND TO UPDATE YOUR DASHBOARD TO 13146 STOP HERE AND 
UPDATE YOUR DASH THEN RETURN TO START OF TUTORIAL 


FimwareTool32 | DVDKey 32 | MTK Rash 32 | HitachiGDR3120 | IRC Channel 


Source | Inquiry | Identify | Drive Serial 
| | Dive User Guide 
C:\JungleFlasher v0.1.74 Beta (138)\New folder\Dummy.bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key* A030 Key 
Lite-On DG-16D2S 83850C LO83info Extract 9B749DEBF3935822C0950FB44B2D 148B 
: Open Source 
OSIG:[PLDS DG-16D2S 8385) Fi 
V| Advanced View 
Ti Inquiry | Identify | Drive Serial pen 
ini | | Dive AE Lite-On firmware loaded to Source buffer! 


@ Do you wish to auto-load Lite-On iXtreme ? 


Dummy.bin file saved to Dummy-.bin a 
Loading firmware from buffer 

Inquiry string found 

Identify string found 

Drive key @ 0xA030 9B749DEBF3935822C0950FB44B2D148B 

Firmware Osig: [PLDS DE-16D25 8385] 

Firmware is: LO83info Extract 

Key added to database 


J7 
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If you have selected YES, target firmware will be loaded and automatically 
spoofed 


Check the keys match and the OSIG/model info is the same! 


FimwareTool 32 | DVDKey 32 | MTK Fash 32 | HitachiGDR3120_ | IRC Channel 


Source | Inquiry | Identify | Drive Serial 
| | User Guide 
C:\JungleFlasher v0.1.74 Beta (138)\New folder\Dummy bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key” A030 Key 
Lite-On DG-16D2S 83850C LO83info Extract 9B749DEBF3935822C0950FB44B2D 148B 
: Open Source 
OSIG:[PLDS DG-16D2S 8385] Fi 
[V] Advanced View 
- = P mE 
Target | Inquiry | Identify | Drive Serial | ae arget 
C:\JungleFlasher v0.1.74 Beta (138)\finmware\octtv 1.1-838.bin n 
Manual 
Vendor Model Rev Firmware Type DVD Key @ n/a Spoofing 
Lite-On DG-16D2S 83850C iXtreme LT 1.1 9B749DEBF3935822C0950FB44B2D148B 
OSIG:[PLDS DG-16D2S 8385] Save to File 
Drive key @ n/a 77777777777777777777777777777777 A 


Firmware Osig: [PLDS DG-16D2Ss 8385] 
Firmware is: iXtreme LT 1.1 

Spoofing Target 

DVD Key copied to target 

Target is LT - ID strings not copied to Target 
Serial data copied from Source to Target 

No Calibration data in source 


Then if you wish you can click Save to File button to save a copy of your hacked 
Firmware. 


CLICK HERE TO CONTINUE TO ERASE/WRITE SECTION 
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Dumping OFW from LiteOn for 83850C v2 & 93450C 


(& All LiteOn flashed with iXtreme LT firmware unless you previously dumped this drive and 


have the details in the Key database) 


When this hack was first released there was several differing methods appeared 
varying mainly in where to connect certain wires and which traces to cut. After 
testing several of them we have listed the popular methods, the original MRA 
Hack, The Xecuter Probe II, The Xecuter LT Switch, Vampire & Rebuild Board, 

and Vampire w/o Rebuild Board 


NOTE: With the release of Jungleflasher 1.70 a section of data is now 
copied over starting from hex address 3C000 this data has been talked 
about as “calibration data” At the time of writing this, it’s thought to 
contain data from manufacture tests but is not used! However for 
completeness is now copied over to your iXtreme firmware. This is 
shown in the running log at time of spoofing the firmware like: 


Spoofing Target 

DVD Key copied to target 

Inquiry string copied to Target 

Identify string copied to Target 

Serial data copied from Source to Target 
Calibration data copied from Source to Target 


A full dump of your VIRGIN drive (not one that has been returned with other 
stock firmware) is the ONLY WAY to get the ORIGINAL DATA from your drive into 
the iXtreme LT firmware. So IF your drive has been flashed before please IGNORE 


oo 


the statement that appears "? Calibration data in source Ss it i, NOT 


important and there is NOTHING you can do — it has been lost forever! 


All the methods involve cutting traces on the PCB! Please 
read on for some handy information regarding this topic! 
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For your information: 


Trace cuts! 


Thickness | 
sal 


geo 


Back-Side 
Copper Plane 


Cutting traces on the PCB: The traces that requires cutting on the PCB are only a thin strip of 


copper laid on top of the PCB! They do NOT need carving up with a chainsaw! A reasonable 
pressure with a sharp craft knife is sufficient to cut through them. Easily less than .Smm thick! 


Moral of the story: You don’t have to cut right through half the PCB to cut the trace! 


Click on the link for the method of your choice! 


The MRA Hack 
Xecuter Probe Il , Xecuter LT Switch 


Vampire With Board , Vampire w/o Board 
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The MRA Hack 
Can be used on ALL current LiteOn Drives 


Soldering/Electronics skills are required for these modifications — It Should NOT 
be attempted by people without such skills! 


Basic wiring guide for the drives PCB 


A 18 - 22 Q resistor is required and a switch such as dpdt (double pole, double 
throw) -using one side only 


3.3volts 


Pic 1 
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myer 


CNOD 


e fee Carrere 
; A E E A r E 


Pic 2 
The 2 trace locations in yellow must be cut! 


With Jungleflasher running, have the switch so it connects 3.3v line to the middle 
cable showing in picture 1 (switch selected OFF). 


Connect drive to PC’s SATA and power drive, select MTK Flash 32 tab 


Refresh, drive properties — so drive shows up 
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FimwareTool 32. | DVDKey 32 |: 


1/0 Port 


OxE800 -J 


Port Properties 


VO Address: 


Type: 


‘| Hitachi GDR3120 | _ IRC Channel 


REFRESH BUTTON 


OxE800 

SATA 

Primary 

Master 

VIA VT6421 RAID Controller 


PLDS 
DG-16D2S 


9345 
OCADA2D609CG92180800 
Not Found 


activate.iso 
360 Tools 


| ST) [woven 


Flash Chip Properties 
Vendor ID: 
Device ID: 


Intro / Device ID Outro / ATA Reset 
Read Erase Write 


This is a 32 
portio32.sys 
portio32-.sys 
Found 1 Com Ports. 
Drive is Lite-On.. 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 15:54:36 2010 


bit process running on 4 x 32 bit CPUs 
Driver Installed 
Driver Started, thanks Schtrom ! 


Turn power off to the drive 


Operate switch you added! To connect to the 22 Q resistor side (On) 


Press intro/ Device ID button 


Pasting Tasks 


The following will appear! Press Yes button 
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> — 
MTK Vendor Intro failed ko m~ 


Eà If you wish to resend the command you should click Yes. 
’ Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Then power on the drive! 


IF this produces a screen showing BAD FLASH PROPERTIES (shown below) 


|_ FirmwareTool 32 | DVDKey 32 | MTK Flash 32 | Hitachi GDR3120 


VO Port VIA ports Only (V $00 aes 
s 
QxE800 ia (acca) Include non-IDE Ports 


Beng Sammy : 
Port Properties UnLock Unlock: | |Lte-On Erase 


activate.iso 


VO Address: 
Type: Flash Chip Properties 
Channel: Vendor ID: OxFF 
Postion: Device ID: OxFF 
Device: Name: Unknown type 
Size: na 
Drive Properties Type: Serial flash with status 0x72 


Vendor: Drive in Vendor Mode! 
: Flashing Tasks 
Name 


Intro / Device ID Outro / ATA Reset 
Fiw Rev: 


Re-sending Vendor Intro: a 


Serial flash found with Status 0x72 


Sending Device ID request to port 
Manufacturer ID: OxFF 

Device ID: OxFF 

Flash Name: Unknown type 

Flash Size: n/a 


m 


then press Intro/Device ID button again — 
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DO NOT POWER CYCLE! 


Flashing Tasks 
Ou ZATA Resa | 
(Red | | Gave | (wee | 


If everything has been done correctly — you should be faced with this! 


FimwareTool 32 | DVDKey32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel 


peed 


VO Port VIA ports Only Bctivete 18 


< 


E800 ~ [...] Include non-IDE Ports 


360 Tools 
Beng S 
Post Properties UnLock Unlock | | Lte-On Erase 


I/O Address: OxE800 


Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxC2 
Postion: Master Device ID: 0x11 
Device: VIA VT6421 RAID Controller E MXIC(MX25L2005) 
262144 bytes 
=y 
Vendor: Drive in Vendor Mode! 
F/W Rev: 
Reserved: Flash Chip Properties 
DVD Key: Not Found Vendor ID- OxEF 
Device ID: 0x11 
Re-sending Vendor Intro: Winbond/NEX(W25P20/NX25P20) 


Serial flash found with Status 0x72 262144 bytes 

Serial flash with status 0x72 
Sending Device ID request to port OxE800 
Manufacturer ID: OxC2 
Device ID: 0x11 $ E egy 
Flash Name: MXIC(MX25L2005) Could look like this if it’s 


Flash Size: 262144 bytes Winbond instead of MXIC 


After you get these good flash properties, quickly operate the added switch again 
to 3v3 side (Off in pic 1) 


Now press the Read button 
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esses Pn : 
[Intro /Device ID. | [ Outro/ATAReset | 


= Cm 


Jungleflasher will now dump your Original LiteOn Firmware, 


When prompted to SAVE — it is advised you do so! 


The dumped firmware will now automatically be loaded into source in 
firmwaretool 32 tab. 


FimwareTool 32 | DVDKey32 | MTKAlash 32 | HitachiGDR3120 | IRC Channel 


Deve, User Guide 


C:\JungleAlasher v0.1.74 Beta (138)\New folder\Lite-OFW bin 
Save Drive 
Vendor Model Rev Firmware Type DVDKey* ma č  ć  ěăć = žě Key 
Lite-On DG-16D2S 93450C Stock 9B749DEBF3935822C0950FB44B2D148B 
: Open Source 
OSIG:[PLDS DG-16D2S 9345] Firmware 
V| Advanced View 
arget |jinguiy | ety | Saal AE Lite-On firmware loaded to Source buffer! 


’ Do you wish to auto-load Lite-On iXtreme ? 


eto File 


OSIG: 


Betting Bank 3s: 22206 ose ceceteee 


Lite-On Dump file saved to Lite-OFW.bin 

Loading firmware from buffer 

Drive key @ n/a 9B749DEBF3935822COS950FB44B2D148B 
Firmware Osig: [PLDS DG-16D2S 9345] 
Firmware is: Stock 

Key added to database 
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Em 


Select Yes 


FimwareTool 32 | DVDKey 32 | MTKAash32 | HitachiGDR3120 | IRC Channel 


Source | inquiry | identify | Drive Serial | 


C:\JungleFlasher v0.1.74 Beta (138)\New folder\Lite-OFW bin 


Vendor Model Rev Firmware Type DVD Key” ma 
Lite-On DG-16D2S 93450C Stock 9B749DEBF3935822C0950FB44B2D 148B 


OSIG:[PLDS DG-16D2S 9345] 


toca ven Sous Tasa Donate. 


Target | inquiry | Identify | Drive Serial 


C:\JungleFlasher v0.1.74 Beta (138)\fimware \icttv 1.1-934 bin 
Vendor Model Rev Firmware Type DVD Key @ nla 


OSIG:[PLDS DG-16D2S 9345] 


Lite-On DG-16D2S 93450C iXtremeLT 1.1 9B749DEBF3935822C0950FB44B2D 148B 


Firmware is: iXtreme LT 1.1 

Spoofing Target 

DVD Key copied to target 

Target is LT - ID strings not copied to Target 
Serial data copied from Source to Target 
Calibration data copied from Source to Target 


Loading MIK_Flash source file 


Now, Just follow the standard write procedure! 
So return to MTK tab 
NOW CLICK HERE! 
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> 


7 


Dumping Firmware from a drive with a Xecuter LT Switch Fitted 
For full fitting instructions go here 


Essentially the board preparation is the similar to the MRA hack but once fitted 
need not be removed and has a switch on it to select between ‘normal’ operation 
and R/W (presumably meaning read/write) though technically all reading and 
writing is done with switch in ‘normal’ position, the R/W position is ONLY used to 
place the drive into vendor mode!, then switched back to normal for reading and 
writing operations. 


NOTE: v1.5 has now been released! Added MULTI-R feature! Select 200s normally 
— if drive status fails to leave 0x51, try selecting 180s or 22Qs and try again. 


Once installed as per fitting instructions, 
With switch in “Normal” position and MULTI-R set to 20 Os 


Connect drive to PC’s SATA and power drive (GREEN LED will be LIT), select MTK 
Flash32 tab 


Refresh, drive properties — so drive shows up 
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FimwareTool 32 | DVDKey 32 |; MTK Ħash 32 | Hitachi GDR3120 | IRC Channel 


activate.iso 


- 360 Tools 
OxE800 v [4 Include non-IDE Ports 


Beng Sammy 
Port Properties UnLock Unlock | | Lte-On Erase 


VO Address: OxE800 


< 


Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: 
Postion: Master Device ID: 
Device: VIA VT6421 RAID Controller Name: 


PLDS 
DG-16D2S 
9345 


OCADA2D609CG92180800 
Not Found 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 15:54:36 2010 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 
portio32.sys Driver Started, thanks Schtrom ! 


Found 1 Com Ports. 
Drive is Lite-On.. 


Turn power to the drive off. 
Operate switch to the R/W position 
Press Intro/ Device ID button 


i | Outo /ATA Reset | 


[Gove] (wo | 


The following will appear! Press Yes button 
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ü 
MTK Vendor Intro failed 


rT 


i, If you wish to resend the command you should click Yes. 
’ Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Then turn power to the drive ON again, 


(Note the LED will now be RED instead of GREEN) 


i= 


IF your drive has a WINBOND chipset then this will produce a screen showing 
further instructions (shown below) 


= 
Device ID Failed ! — 


i Please return LT-Switch to the Normal position ! 


Then, press OK to continue. 


then put LT Switch back to Normal and press OK 


If everything has been done correctly — you should be faced with this! 
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Firmware Tool 32 DVDKey 32 MTK Flash 32 Hitachi GDR3120 IRC Channel 
1/0 Port VIA ports Only activate. isc 
360 Tools 
OxE800 ~ [...] Include non-IDE Ports 7 
Beng Sammy i 
Port Properties | UnLock | | UnLock | iene 
I/O Address: OxE800 
Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxC2 
Postion: Master Device ID: 0x11 
Device: VIA VT6421 RAID Controller MXIC(MX25L2005) 
262144 bytes 
Drive Properties Serial flash with status 0x7, 
Vendor: Drive in Vendor Mode! 
TE Flashing Tasks 
F/W Rev: Intro / Device ID 
Reserved: Read 
DVD Key: Not Found Rash Chip Properties 


Vendor ID: OxEF 


Re-sending Vendor Intro: 


Serial flash found with Status 0x72 


Sending Device ID request to port OxE800 
Manufacturer ID: OxC2 

Device ID: 0x11 

Flash Name: MXIC(MX25L2005) 

Flash Size: 262144 bytes 


Device ID: 0x11 
Name Winbond/NEX(w25P20/NX25P20) 
Size 262144 bytes 
Serial flash with status 0x72 


Type: 


Could look like this if it’s Winbond 
instead of MXIC 


Once you have the Correct status (shown above), 


Now press the Read button 


Flashing Tasks 


Intro / Device ID. | | Outro/ATAReset_ | 


Ee 


White 


Jungleflasher will now Dump your Original LiteOn Firmware, 


When prompted to SAVE it is advised you do so! 
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The dumped firmware will now automatically be loaded into source in 
firmwaretool 32 tab. 


FimwareTool 32 | DVDKey 32 _| MTK Rash 32_ |. Hitachi GDR3120 


User Guide 
C:\JungleFlasher v0.1.74 Beta (138)\New folder\Lite-OFW bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key * va äăěăë OP Key 
Lite-On DG-16D2S 93450C Stock 9B749DEBF3935822C0950FB44B2D 148B 
t £ Open Source 
OSIG:[PLDS DG-16D2S 9345] Bevan. 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


Beading Hank 3: ..-.<-<=-.-<-<s---< 


Lite-On Dump file saved to Lite-OFW-.bin 

Loading firmware from buffer 

Drive key @ n/a 9B749DEBF3935822COSS0FB44B2D148B 
Firmware Osig: [PLDS DG-16D2S 9345] 
Firmware is: Stock 

Key added to database 


4 


Select Yes 
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FimwareTool 32 | DVDKey 32_| MTK Fash 32 | HitachiGDR3120 | IRC Channel 


C:\JungleFlasher v0.1.74 Beta (138)\New folder\Lite-OFW bin 


Vendor Model Rev Firmware Type DVD Key* ma 
Lite-On DG-16D2S 93450C Stock 9B749DEBF3935822C0950FB44B2D 148B 


OSIG:[PLDS DG-16D2S 9345] 


A Donate 


C:\JungleFlasher v0.1.74 Beta (138)\firmware\octtv 1.1-934 bin 


Vendor Model Rev Firmware Type DVD Key@ n/a 
Lite-On DG-16D2S 93450C iXtremeLT 1.1 9B749DEBF3935822C0950FB44B2D 148B 


OSIG:[PLDS DG-16D2S 9345] 


User Guide 


Key 


Firmware is: iXtreme LT 1.1 

Spoofing Target 

DVD Key copied to target 

Target is LT - ID strings not copied to Target 
Serial data copied from Source to Target 
Calibration data copied from Source to Target 


Loading MIK_Flash source file 


Just follow the standard write procedure! 
So return to MTK Flash 32 tab 
NOW CLICK HERE! 
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> 


nı) 


A 


Xecuter Probe Il Method 


Connect the Xecuter probe II to the CK3 Pro. 
Make sure the OP Switch is in the UP (ON) position and switch the mode to MRA. 


Power on the CK3 pro you will see that the Xecuter probe II BLUE POWER LED is on and the MRA 
GREEN NORMAL LED is on (IF RED is LIT — op-switch is in WRONG position). This shows that 
everything is functioning. 


Now turn the CK3 Pro power OFF. 


9313x ERN à i 
3 


a = 


Use a fiberglass scratch pen and clean up the 2 holes to make the Probes contact better — Do this 
before cutting traces, as you are less likely to stress the pad 101 while it’s still connected to trace 


Cut traces on the PCB. The cuts are small and not difficult to do. Most people use a Xacto knife or a 
small dremel tool. Make 2 small cuts where the yellow lines are. . (Be very careful not to damage 


pad 101, once cut from the trace it becomes quite fragile) 
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Probe V2 trace cut and touch point 
@ @: pogo touch point 
| =: trace cut 


perar 4 
ries cite 


Now take the Xecuter Probe II and place the points onto the marked red and green positions. The 
Probe's pins are clearly marked. Remember at this stage the CK3 Pro power should be OFF. 


Now turn the CK3 Pro power switch to on. You will now see the Xecuter Probe II BLUE POWER LED 
come on and also the MRA GREEN NORMAL LED come on. 
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Refresh the I/O port in Jungleflasher on MTK tab. You should see the DVD drive properties if 
everything is connected and setup correctly. This is also an indication that your SATA is setup 
correctly. You may need to select another I/O port then return to the correct I/O port for it to 

show properly. 


Drive Properties 
Vendor: FLDS 
Name: DG-16025 


FAN Rew: O45 
Reserved: OCAQA2D609CG97180800 
DVD Key: Not Found 


(ONLY EXAMPLE — You will see FW revision of YOUR drive) 


Press the Intro/Device ID Button 
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Turn the power OFF on the CK3. Push the OP Switch on the Xecuter Probe II down 


Press Yes! — Then power ON CK3,(RED LED — if it doesn’t go on — don’t worry — continue) 


E 
Vee A ko ~~ 


$ If you wish to resend the command you should click Yes. 
y Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


(NOTE: If you have a Winbond IC you may see a warning to switch LT switch back to normal then 
press ok! Simply operate OP Switch to up position then click ok) 
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r 
Device ID Failed ! epe 


i Please return LT-Switch to the Normal position ! 


Then, press OK to continue. 


You should now get Status 0x72 and you are in vendor mode. As soon as you see the flash chip 
properties switch the OP SWITCH up to Normal mode right away (Green LED). Hold probes in place 
and dump firmware by pressing READ button, 


Flash Chip Properties 
Vendor ID: OxC2 
Device ID: 0x11 
Name MXIC(MX25L2005) 
Size 262144 bytes 
Type Serial flash with status 0x72 


Intro / Device ID Outro / ATA Reset 


me) Cie 


Now you have a choice, you can either 


1. ONCE "save" button appears you can remove probe, power off CK3 and SAVE that OFW 
Once you have dumped the drive simply repair the traces with the conductive glue that is 
included with the Xecuter Probe II (or use your own if you bought the early batch that wasn't 
included - simply solder) and you can then proceed to erase and flash your liteOn as normal! 


Simply load your Lite-OFW as source (if you have closed Jungleflasher whilst you repaired 
your PCB traces) AUTO load the target firmware, then Proceed to ERASE & WRITE 


OR 


2. Continue to hold probe in place, allow JF to Autololad the fw, select Mtk tab then press 
WRITE (remember to repair your trace cuts when finished!- before testing in console ). 
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Vampire Using Rebuild Board 


Install the Rebuild board as shown on 360Xtractor website. 
On MtkFlash32 Tab of Jungleflasher — Press intro/Device ID Button then press the Yes 
on the pop-up window that appears. 


Outro / ATA Reset 


White 


Which will lead to show the following 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 
Found 0 Com Ports. 

Sending Vendor Intro to port 0xE800 

Status Ox7F 

Re-sending Vendor Intro: 


DONT POWER XTRACTOR YET. 


PRESS THE BUTTON ON THE VAMPIRE AND HOLD IT, then make the PIN101 Probe 
touch the “VAMPIRE P101” Pad on the rebuild board, 


IMPORTANT, IT’S RECOMMENDED - TOUCH ON THE PAD SURFACE AND NOT ON THE 
HOLE. 
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Ae < — : "Fy 


While you are holding the button in and the probes are in contact with board 
TURN ON XTRACTOR 


after 1 or 2 seconds you should see the drive gets detected with a Status 0x72 
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|_FimwareTool 32 | DVDKey32 | MTK Fash32 | HitachiGDR3120 | IRC Channel 


I/O Port VIA ports Only Bctivate isc 


360 Tools 
OxE800 ~ [k] Include non-IDE Ports 


a Beng Sammy 
Post Properties UnLock Unlock | | te-On Erase 


I/O Address: OxE800 


< 


Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxC2 
Postion: Master Device ID: 0x11 
Device: VIA VT6421 RAID Controller z MXIC(MX25L2005) 
262144 bytes 
Drive Properties : Serial flash with status 0x72 
Vendor: Drive in Vendor Mode! 
Name: 
Fiw Rev: 
Reserved 


Serial flash found with Status 0x72 


Sending Device ID request to port OxE800 


Manufacturer ID: OxC2 E 
Device ID: 0x11 

Flash Name: MXIC(MX25L2005) 
Flash Size: 262144 bytes 


m 


In case you get STATUS 0x72 but the VENDOR ID/DEVICE is OxFF press INTRO/DEVICE 
ID If status keeps OxFF try removing the Vampire first then press INTRO/DEVICE ID 
Button 


Now if you have not done, remove the Vampire from touching the board and press 
READ button 
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Power off the 360xtractor and proceed to join jumper as required! 


Once you have soldered the jumper of your choice! Power on the 360xtractor again — 
Proceed to 


ERASE & WRITE 
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Using Vampire if you are NOT USING REBUILD BOARD! 


Visit website. For their own Tutorial — they suggest cutting PCB as follows 


7 os KEES 


4-R-P 
pas.) 


clas 


190r 


YOU CANARY =24Ers 
BUT YOU NEA AE H OTRE = 


4-R-P 


NAYI AALAN A 


On MtkFlash32 Tab of Jungleflasher — Press intro/Device ID Button then press the Yes 
on the pop-up window that appears 
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Flashing Tasks 


is 
Read Erase Write 


Which will lead to show the following 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. 

Sending Vendor Intro to port OxE800 

Status Ox7F 

Re-sending Vendor Intro: 


Probe the 101 pad and 3.3v points on PCB whilst holding the button on vampire 
pressed in! 
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While you have the button on Vampire pressed in and probing the correct holes 


TURN ON XTRACTOR, 


after 1 or 2 seconds you should see the drive gets detected with Status 0x72 
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FimwareTool 32_| DVDKey 32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel 


W/O Port VIA ports Only activate ise 
= 360 Tools 
E800 ~ f Include non-IDE Ports [V 
Beng Sammy 
Port Properties | UnLock | | UnLock | en Ese 
VO Address: OxE800 
Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxC2 
Postion: Master Device ID: 0x11 
Device: VIA VT6421 RAID Controller : MXIC(MX25L2005) 
262144 bytes 
Drive Properties : Serial flash with status 0x72 
Vendor: Drive in Vendor Mode! 
Name: Fle 
oe [Intro /Device ID | | Outro/ATAReset | 
jnonighans [Read | [ Ese | [{ Wrte | 
DVD Key: Not Found 


Re-sending Vendor Intro: 


Serial flash found with Status 0x72 


Sending Device ID request to port OxE80 


Manufacturer ID: OxC2 
Device ID: 0x11 

Flash Name: MXIC(MX25L2005) 
Flesh Size: 262144 bytes 


Now release the button on vamp 
whilst still Holding the probes in contact with PCB 


Then press READ! 


Flashing Tasks 
Intro / Device ID Outro / ATA Reset 


Ce) Gee) ie 


when the “Save” option appears it’s safe to remove probe from PCB 


Power off the 360xtractor 


Proceed to join jumper with solder as required! 
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m 


Once you have soldered the jumper of your choice! Power on the 360xtractor again — 
Proceed to 
ERASE & WRITE 
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Return a LiteOn to Stock Firmware 


To return a LiteOn drive to stock you need your Dummy.bin and a Stock FW for 
your relevant drive. 


Simply load your Dummy as Source, Decline the Auto load of iXtreme firmware, 


User Guide 
JABACKUPS - my xbox\\Durmeny 1 bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 Key 
LiteOn DG-1602S 83850C Dummy from GIDSCESZS7BSAISSFAF 1334FFABIIGA2 
LO83info, bin. kev FS 
Open Source 
OSIG:[PLOS DG-1602S 8385) | Fi 
¥ Advanced 
Target | inquiry, Open Target 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


OSG 


s mm | 


Loading firsware file J:\BACKUPS - my xbox\Dummyl.bin 
MDE hash: 4€fdc8e8S0etdiaScfazaS2chaaSéSéé 

Inquiry string found 

Identify string found 

Drive key @ OxA030 G1DSCESISTSSASSIFAFLSS4FFABI1GAZ 
Firmware Osig: [PLDS DG-16025 6385) 
Firmware is: Dummy from LO83info.bin.key 


m 


Load the stock firmware as target! 


Then press Spoof Source to Target button 
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FimwareTool 32 | DVDKey 32 | MTK Aash 32_|_ Hitachi GDR3120 
Soi = af P3 s, 
urce Inquiry | Identify | Drive Serial | User Guide 
J:\BACKUPS - my xbox\\Dummy1 bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 
Lite-On DG-16D2S 83850C Dummy from 61D8CE929789A349FAF 1334FFAB118A2 
LO83info.bin.kev 
3 Open Source 
OSIG:[PLDS DG-16D2S 8385] Fi 
Ane ven CE Donate, 
Target | inquiry | Identify | Drive Serial | Open Taust 
J:\JFBeta.0.1.69\Fimware\83850C.BIN 
Manual 
Vendor Model Rev Firmware Type DVD Key @ nma Spoofing 
Lite-On DG-16D2S 83850C Stock A36A3D78502989622195153326F8CA9E 
OSIG:[PLDS DG-16D2S 8385] Save to File 


Check the running log to see all the info has been copied over, double check the 
key matches. Then if required, press Save to File button! 


FirmwareTool 32 | DVDKey 32 | MTKAlash 32 | Hitachi GDR3120 
Source | Inquiry | Identify | Drive Serial 
| User Guide 
J:\BACKUPS - my xbox\Dummy1.bin — 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 Key 
Lite-On DG-16D2S 83850C Dummy from 61D8CE929789A349FAF1334FFAB118A2 
LO83info.bin.kev 
5 Open Source 
OSIG:[PLDS DG-16D2S 8385] Fi 
ie a Sei aaa 
Target | Inquiry | Identify | Drive Serial Open Target 
J:WFBeta.0.1.69\Fimmware\83850C.BIN 
Manual 
Vendor Model Rev Firmware Type DVD Key @ ns Spoofing 
Lite-On DG-16D2S 83850C Stock 61D8CES29789A349FAF1334FFAB118A2 
OSIG:[PLDS DG-16D2S 8385] Save to File 
Firmware Osig: [PLDS DG-16D2S a 


Firmware is: Stock 


Spoofing Target 


DVD Key copied to target 

Inquiry string copied to Target 
Identify string copied to Target 

Serial data copied from Source to Target 


4 niiin] 


PROCEED TO ERASE & WRITE — CLICK HERE! 
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Using the KeyDatabase to Retrieve/Create your Firmware 


So — you have connected your drive that you flashed already! You know it’s in 
your Key Database as you flashed it previously. Connect it and refresh the port! 


| FimwareTool 32_| OVDKey 32 | MTKFlash 32 | Hitachi GDR3120 | IRC Channel_| 


VO Port VIA ports Only [E] Com Port USB Xtractor Switch 
~ [..] include non-DE Ports [V] COM7 -| {J Dummy bin Only [¥] 
Port Properties Com Port Properties 

I/O Address: OxA000 Port: COM7 

Type: SATA Type: Xecuter CK3 Pro (Rev D) 

Channel: Primary Name: Prolific USB-to-Serial Comm Port 

Postion: Master Status: Ready 

Device: Standard Dual Channel PCI IDE : 

Controller Drive 


Drive Properties 
Vendor: PLDS 


Name: DG-16D2S 
Fiw Rev: 7485 


Reserved: OCA0A1D608CG82081402 
DVD Key: Verified E 


JungleFlasher 0.1.74 Beta (138) 
Session Started Sat May 22 15:04:34 2010 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 
portio32.sys Driver Started, thanks Schtrom ! 


Found 1 Com Ports. 
Drive is Lite-On.. 


Just from refreshing the port Jungleflasher has identified that you have previously 
dumped this drive, it looks up the key from the database and tests it on the drive! 
— It’s verified! © 


So WITHOUT Opening the drive - you know what the key is for this drive! 
As it’s in the Key Database. 


To use this information to re-flash your drive with an update or back to stock 
firmware, you have several choices! Follow the route below 
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The other options in that menu are self-explanatory! If you need to ask what they 
do then maybe you shouldn’t be modding drives! 
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IF you want to open the folder containing the firmware you dumped from the 
drive originally select Open Job Folder 


Organize v New folder = ~ O @ 


[l$ Downloads ^ Name Date modified Type 
E] Recent Places 


| _] Dummy.bin 22/05/2010 2:54 PM Open 
Libraries 
B Documents 
6) Downloads 
D Music 
| Pictures 
E Videos 


® Homegroup 


jE Computer 
&, Win 7086) (C:) 
cw DATA (D:) 
cam Local Disk (E) v < {ims Á 


Filename: Pal Firmware file (*.bin) A 


Select the Dumm y.bin or Lite-OFW.bin (dependant on how you dumped firmware 
in first place) 


NOTE : If you have moved the folder you will see this! 


<= Folder "7 


A Job Folder was not found. 


(CuK) 


If you know where it is CLICK HERE 
NOTE: IF YOU DONT HAVE THE FIRMWARE SAVED? CLICK HERE 
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It will open as source and auto load the latest iXtreme firmware. 


FimwareTool 32. | DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


Source | inquiry | Identify | Drive Serial 


C:\JungleFlasher v0.1.74 Beta (138)\New folder\Dummy.bin 


Vendor Model Rev Firmware Type DVD Key @ A030 
Lite-On DG-16D2S 74850C DVDKey32 extract  9B749DEBF3935822C0950FB44B2D148B 


OSIG:[PLDS DG-16D2S 7485] 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


User Guide 


Save Drive 


Found 1 Com Ports. 

Drive is Lite-On.. 

Loading firmware file C:\JungleFlasher v0.1.74 Beta (138)\New folder\Dummy-.bin 
MDS hash: 2ccacaebd7fc650810357a53d46764af 

Inquiry string found 

Identify string found 

Drive key @ 0xA030 SB749DEBF3935822COSSO0FB44B2D148B 

Firmware Osig: [PLDS DG-16D2S 7485) 

Firmware is: DVDKey32 extract 


Then follow the normal ERASE/WRITE procedure 
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Have the firmware saved in another location? Go to Firmwaretool 32 tab, right- 
click over the source section and select load fw or click Open Source Firmware 
button 


FimwareTool 32 | _DVDKey 32 _|_ MTK Fash 32_| Hitachi GDR3120_| IRC Channel 


Source | Inquiry | Identify | Drive Serial 


Verify Key 


User Guide 
ave Unve 
Vendor Model Rev Firmware Type DVD Key @ Key 
: Load f, Open Sout 
OsIG: | oad f/w pen Sou 
| Clear Source 
[V] Advanced View Spa Update d/b am. 
— ee en Open Key d/b -Donate — a 
5 5 5 - en Ta 
Target | Inquiry | Identify | Drive Seral | History pen Target 


Vendor Model Rev Firmware Type DVD Key @ 


OSIG: Save to file 


Open the firmware file you think is the correct Dummy.bin or Lite-OFW.bin 


Allow it to autoload the latest iXtreme Firmware. Then right-click over the source 
firmware section again. Select Verify Key. 


DVDKey 32_ | MTK Flash 32_| Hitachi GDR3120_|_ IRC Channel 


Firmware Tool 32 


Soi = 7 = = 
uoe naan | kdenišy, | Dive Serial | User Guide 
C:\JungleFlasher v0.1.74 Beta (138)\old\Lite-OFW bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key@ na Key 
Lite-On DG-16D2S 93450C Stock 9B749DEBF3935822C 0950FB44B2D 148B 
OSIG:[PLDS DG-16D25 9345] Open Sores 
| Load f/w 
I Clear Source 
V| Ad 
[V] Advanced View Spoof Sout 
| Update d/b es 
z = z 5 Open Target 
Target [Inquiry | Identify | Drive Serial Open Key d/b palei 
| History 
C:\JungleFlasher v0.1.74 Beta (138)\fimware \octtv ] : 
Verify Key Manual 
Vendor Model Rev Firmware Type 
Lite-On DG-16D2S 93450C iXtremeLT 1.1 9B749DEBF3935822C0950FB44B2D 148B 
OSIG:[PLDS DG-16D2S 9345] Save to File 


Now check the Running log for this! 


Attempting to verify Source Key to drive on port OxE800 


It’s Verified against drive © click MTKFlash 32tab and proceed to ERASE/WRITE 
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Things not going as expected? — Read the FAQ’s 


Using the KeyDatabase to Create your Firmware 


If you are convinced that you have flashed this drive before (regardless of type) 
but it doesn’t show as verified initially - you can test all the keys in your Key 
Database by using “Dummy from KeyDB” it will only create new firmware for Lite- 
ons but it will find the correct key of other types of drive, if you have it in the 
database! (if you have a lot of keys in DB it may take some time) 


You no longer have the Dummy.bin or OFW.bin but the drive is showing as 
verified in KeyDB? 


Connect the drive and refresh the port, ensure it shows up as having a verified 


key. 
FimwareTool 32 | DVDKey32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel 
activate.iso 
1/0 Port USB Only [V] VIA ports Only 360 Tools 
00000 X Cad Include non-IDE Ports | Beng | | Sammy | | Lite-On | | Slim | 
Se UnLock UnLock Erase UnLock 
VO Address: 0x0000 74 
A ko Flash Chip Properties 
Channel: Primary è F 
eee ane Device ID: 
Device: XECUTER X360USB PRO man 
{ Ver 0.18 ) Size: 
Type: 
PLDS Flashing Tasks 
DG-16D2S | intro /Device ID] | Outro /ATAReset | 
7485 
0CA0A1D608CG83390701 [Read | [ Erase] [ Wie | 
Verified E Phat @) © Slim 


XECUTER X360USB PRO attached. 


PortIO unloaded. 
Drive is Lite-On.. 


Key found in KeyDB at record (1 - JFBeta) 
Key is: 55ED8C1FA3572E4F34AC176E76EFED34 
Key has been tested and verified, thanks C4eva ! | jj 


Click Dummy from KeyDB button 
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_ Dummy from KeyDB Dummy from iXtreme 


Then it will ask you to save the new Firmware it has created from the Key DB and 
querying the drive itself. 


f 


ge Save À i 
Ja > Computer > DATA (F) > JFBeta > + | #4] [ Search JFBeta i p 
Organize ~ New folder E~” @ 
[| Documents “~ Name j Date modified Type Size 
=] Downloads l 
$ Ta p Firmware 04/03/2011 20:26 File folder 
ae |] BENQ-OFW.bin 04/03/2011 21:46 BIN File 256 KB 
E] Pictures $ i 
5 [|] Dummy.bin 14/03/2011 19:42 BIN File 256 KB 
E Videos i 3 $ 
[C] Hit-OFW.bin 14/03/2011 19:47 BIN File 256 KB 
|} Identify.bin 02/03/2011 12:23. BIN File 1KB 
& Homegroup BAE i i 
_) Inquiry.bin 02/03/2011 12:28 BIN File 1KB 
|) Key.bin 02/03/2011 12:28 BIN File 1KB 
j Computer = : | 
|] SAM-OFW.bin 04/03/2011 21:32 BIN File 256 KB 
& Local Disk (C:) ae 
[C] Serial.bin 02/03/2011 12:23. BIN File 1KB 
© OLD win7 (E) 
ca DATA (F:) 
(a Local Disk (G:) 
a Local Disk (H:) 


Ale... Y ote. = SREY 


Then will automatically load the new firmware as source 
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Firmware Tool 32 MTK Flash 32. | Hitachi GDR3120 


Vendor Model Rev Firmware Type DVD Key @ A030 Key Xecuter 
Lite-On DG-16D2S 74850C 55ED8C1FA3572E4F34AC176E76EFED34 — 


OSIG:[PLDS DG-16D2S 7485] The Hottest 


pr ee i Product of 


[Tae | 2011! 
_ Lite-On firmware loaded to Source buffer! imware ® 


Do you wish to auto-load Lite-On iXtreme ? 


F:\JFBeta\SAM-OFW bin 


Vendor Model Rev Firmwa 
Samsung TS-H943A MS28 Stock 


OSIG:[TSSTcorpDVD-ROM TS-HS 


Loading firmware from buffer 

Inquiry string found 

Identify string found 

Drive key @ 0xA030 SSED8C1FA3572E4F34AC176E76EFED34 
Firmware Osig: [PLDS DG-16D2S 7485] 
Firmware is: 

Key database updated 


Click Yes, 
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FimwareTool 32 | DVDKey 32_| MTK Flash 32 | HitachiGDR3120_|_IRC Channel 


Soc 


Vendor Model Rev Firmware Type i DVD Key @ A030 
Lite-On DG-16D2S 74850C 55ED8C1FA3572E4F34AC176E76EFED34 


OSIG:[PLDS DG-16D2S 7485) 


Pane ver Se ane a Coonat y si 


Open Target 
kinan Fimware 
F:\JFBeta\Fimware\LTPlus-748v1.1.bin 
Manual 
Vendor Model Rev Firmware Type DVD Key @ nla Spoofing 
Lite-On DG-16D2S 74850C LT-Plus 1.1 55ED8C1FA3572E4F34AC176E76EFED34 
OSIG:[PLDS DG-16D2S 7485] Save to File 


Drive key @ n/a 77777777777777777777777777777777 
Firmware Osig: [PLDS DG-16D2S 7485) 
Firmware is: LT-Plus 1.1 

Spoofing Target 

DVD Key copied to target 

ID strings already match 

Serial data already matches 

No Calibration data in source 


> 


then follow the normal procedures for erasing and writing to the drive! 
For Slim LiteOn 9504 CLICK HERE 


For Phat LiteOn CLICK HERE 
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Removing VIA drivers (Windows XP/Vista/Win 7) 


NOT TO BE DONE IF YOUR MAIN HARD DRIVE IS ON VIA SATA CARD or IF YOUR 
VIA CHIPSET IS ONBOARD(i.e. NOT A PCI CARD) 


This is how | done it, it worked fine, may not be 100% 


Right Click My Computer, select properties 


Open 
Explore 
Search... 
Manage 


Map Network Drive... 
Disconnect Network Drive... 


Create Shortcut 
Delete 
Rename 


Properties 


Click the “Hardware” tab 


System Properties 


System Restore | Automatic Updates | Remote 


General Computer Name Advanced | 


System: 
Microsoft Windows XP 
Professional 
Version 2002 
Service Pack 2 


Registered to: 
Ogay 


Computer: 
AMD Athlon{tm) 64 x2 Dual 
Core Processor 5000+ 
2.61 GHz, 3.00 GB of RAM 
Physical Address Extension 


z 


Then, click “Device Manager” 


Manage 


Map network drive... 


Disconnect network drive... 


Create shortcut 
Delete 


Rename 


Properties 


Click “Device Manager” 


a 


= 


> Control Panel » System and Security » Syste 


Control Panel Home 


(@ Remote settings 


View basic informat 


Windows edition 
Windows 7 Ultimate 
(® System protection Copyright © 2009 Mic 


| @ Advanced system settings 


System 


Manufacturer: 


Rating: 
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System Properties ale 
System Restore Automatic Updates Remote 
General Computer Name Hardware Advanced 


Device Manager 


The Device Manager lists all the hardware devices installed 
= on your computer. Use the Device Manager to change the 


properties of any device. 


Drivers 


pers Driver Signing lets you make sure that installed drivers are 
compatible with Windows. Windows Update lets you set up 
how Windows connects to Windows Update for drivers. 


Hardware Profiles 


%, Hardware profiles provide a way for you to set up and store 
different hardware configurations. 


Hardware Profiles 


Apply 


BOTH OS INSTRUCTION’S NOW BECOME IDENTICAL 


Navigate to “SCSI and RAID Controllers” and click the + sign to expand the list 


File Action View Help 


e» HS @H A 


g OGGY-D364C2231E 


+) BM Acronis Devices 
+) Computer 
+) See Disk drives 
+) E} Display adapters 
=) DYD/CD-ROM drives 
$ PIONEER DVD-RW DYR-115D 
$ PIONEER DVD-RW DYR-215D 
% 5J5Z MNOHA3K9I SCSI CdRom Device 
=- Floppy disk controllers 
$ Standard floppy disk controller 
(Gg Human Interface Devices 
{Gy IDE ATAJATAPI controllers 
Sy IEEE 1394 Bus host controllers 
> Keyboards 
T5) Mice and other pointing devices 
Monitors 
E9 Network adapters 
A Ports (COM & LPT) 


FE Fe 


S Sound, video and game controllers 
<S Storage volumes 

+ System devices 

+ 2 Universal Serial Bus controllers 

+- Y50 devices 

+E Xbox 360 I/O Device Drivers 


g 
+ 


Right Click the VIA 6421 RAID Controller (may report as 3249 if using 550b drivers or above) and 
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select Disable 


=| SCSI and RAID controllers 
& A1EOJPLR IDE Controller 
G] m alle 
+), Sound, video and gam) __Update Driver... 
+) Storage volumes 
+ System devices Uninstall 
+ g Universal Serial Bus co 
+ V50 devices 
+) BB xbox 360 I/O Device C= Properties 


Scan for hardware changes 


Acknowledge the warning by clicking Yes 


VIA VT6421 RAID Controller 


A Disabling this device will cause it to stop functioning. Do you really want to disable it? 


It should now show as disabled in Device Manager like so: 


= & SCSI and RAID controllers 
© 41E0JPLR IDE Controller 


VIA ¥T6421 RAID Controller 


Now, to remove drivers we must navigate to where relevant file is 


mine were located, and most will be: C :\WINDOWS\system32\drivers\ XXXXXXX.sys file — 


Depending on your motherboard and OS i 


For XP normally called viamraid.sys 


For Vista/Win 7 normally called vsmraid.sys 


For some x64 setups it may be called viamrx64.sys 


Once found, delete this file. 


Once deleted, go back to device manager using the same steps outlined above. 


Find your disabled VIA 6421 Card, right click and select enable 
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& SCSI and RAID controllers 
© 41E0JPLR IDE Controller 


®, Sound, video and game c Update Driver... 
<æ Storage volumes 


g System devices Uninstall 


HHE 


Universal Serial Bus contr 


€ Scan for hardware changes 
+- YSO devices 


It should now show as the image below 


- & SCSI and RAID controllers 
© A1EOJPLR IDE Controller 
VIA ¥T6421 RAID Controller 
®, Sound, video and game controllers 
& Storage volumes 
System devices 
2 Universal Serial Bus controllers 


<> v50 devices 


FE F-E 


If so, reboot your PC 
Upon reboot, verify VIA 6421 still has a Yellow Exclamation Mark in Device Manager 


You have successfully removed VIA drivers from your machine 


CLICK HERE TO RETURN TO STARTING POINT 
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Manual Spoofing 


Hopefully the excellent key, OSIG and serial spoofing of FirmwareTool32 should satisfy your 
needs, but sometimes you need the manual method for whatever reason. 


Located in FirmwareTool32 


You need the firmware you wish to Spoof loaded into the target buffer 


NOTE- You CANNOT SPOOF a Drive with 


LT/LT+ Firmware as a DIFFERENT DRIVE} 


Once loaded, Click Manual Spoofing 
Open Target 
Firmware 
Manual 
Spoofing 
Save to File 


Changing Drive Keys 


Here you can manually type a Drive Key — It must be in Hex-Decimal format. It should ONLY 
EVER really be used if you have your Drive Key in a text file or email. 


If you have a key.bin or ‘Original Firmware’ you can save to key.bin as shown above in the Save 
key to file section and use the Load key.bin option 


m 


Load key. bin 


Just click load key.bin and navigate to your key.bin file, select it then it will automatically load it 
into the Manual Spoof Window. 


Changing Drives OSIG (String ID) 


Page 161 of 272 


Things not going as expected? — Read the FAQ’s 


Simply select the drive you want your new drive to report to the console as, from the drop 
down list and click OK. 


If Changing OSIG to a Lite-On PLDS DG-16D2S this will activate the Lite-On Barcode section of 
Manual Spoofing, please see below for instructions. 


Spoofing Lite-On Barcode into Inquiry String 


This is for Spoofing a drive in place of a Lite-On manually, once Drive Key is inserted, you will 
want to spoof as PLDS DG-16D2S, next you want to load your identify.bin by clicking Load 
Inquiry.bin and navigating to Inquiry.bin, upon selecting it, JungleFlasher will load it into the 
window, now you can click OK to finish spoofing the firmware. 


If you don’t have the Inquiry.bin file, JungleFlasher will let you manually type the barcode 
(located on the top of the Lite-On) into the cox, in the format of 17 Alpha-Numberic Characters 
followed by 3 spaces. You MUST include the spaces manually. 


e.g. 


D608CG82690600G2W___ 


Then, click Ok to finish Spoofing the Firmware 


CLICK HERE TO RETURN 
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USB Only, VIA Ports only & Include Non IDE ports 


Found under DVDKey32 tab, 


VO Port USB Only [~] VIA ports Only 
x0000 ~ [k] Include non-IDE Ports [7 
USB Onl 


This feature allows automatic selection of the use of the new X360USB Pro from Xecuter 


Checking the box unloads the PortlO Drivers too (less unnessasary stuff running!) 


VIA Ports Only 


This feature suits those who have quirky onboard Sata Cntrollers ( SIL, JMicron) and a VIA6421 
PCI Sata Card. 


Checking the box removes all non-via sata ports, this will stop you trying to Inquire / DVDKey a 
drive on your non-via SATA/IDE ports. Some chipsets don’t like the Inquiry and will hang the 
system. 


**NOTE** If you do not actually have any VIA ports, JungleFlasher will itself uncheck the box 
and re-enable the non VIA ports 


Include non-IDE Ports 


This option allows you to scan port for contollers Classed as SCSIAdapter. Some newer chipset 
use the Class rather than hdc (aka IDE). However this will also show actual SCSI contoller which 
are obviously of no use for flashing. Please avoid this function unless you know what you are 
doing. 


CLICK HERE TO RETURN 
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LiteOn ‘Serial Fixer’ 


If you are prompted that serial data is missing in an error similar to this: 


Loading Dummy.bin 


Dummy.bin is missing some drive specific information. 


If possible you should re-extract your drive info again 
with the latest tools.. 

1. JungleFlasher, this tool - DVDKey32 Tab 

2. Dosflash 1.7+ 

3, DVDKey32 0.7+ 
You can rebuild the serial info if you have the original 
drive available. Tick advanced view, select the Serial 
sub-tab in the Source tab. Double-click the serial data 
to launch the Serial Re-build applet. 


Do you wish to proceed anyway ? 


Lrs JL] 


To fix proceed, click Yes. 


JungleFlasher will then, ask if you wish to repair this data (only possible if you have original 
source liteon available). 


Loading Dummy.bin 


X) Do you wish to repair the serial from drive barcodes? 


Lrs JLi J 


Click yes to rebuild data. 


JungleFlasher will then pop up the Serial Rebuilder Applet 


Update Serial Info 


Cover 


19929299090999999299999999 


L 
PCB 


To rebuild the Serial Data you must copy the information from the physical drive itself, into the 
boxes in the applet shown. 
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The data required is located in 4 places: 
1. The Drive Chassis / Shell 
2. The Hardware Revision of the drive 
3. The Laser 


4. The PCB of the drive itself 


1. The Drive chassis / Shell 


Located on the top of the drive, and 17 Characters long 


Insert into the cover area on the Serial Rebuilder 
2. Hardware Revision 


Possibly the easiest of the four, located on the top sticker of the drive and usually 
AOA1 or AOA2 


Insert this data into the HW Ver section of the Serial Rebuilder 


3. The Laser 
Self explanitory, located on the base of the laser. 
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Insert this into the Laser area of the Serial Rebuilder 


4. The PCB of the Drive 
You will need to remove the top of the Drive Case to see this data and it is sometimes obscured 
by pen. 
The Data will start S4P...... It’s the 2" and 3™ Line you require 


Insert this data to the PCB section of the Serial Rebuilder 
Once done, click Ok, and save Dummy_fixed.bin when prompted 


CLICK HERE TO RETURN 
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Spoofing as a different type of drive 


Apart from spoofing a hitachi drive(as another type), the technique is very simple! 
To begin with you should have a original dump from the drive you wish to “clone” 


NOTE- You CANNOT SPOOF a Drive with LT 
Firmware as a DIFFERENT DRIVE 


— so, you should have a pre dumped bin file from the donor drive! 


for LiteOn a Dummy.bin 
for Samsung a Sam-OFW.bin 

for Benq a Ben-OFW.bin 

for hitachi a Hit-OFW.bin 


Now follow the tutorial to unlock (follow the tut for that specific drive up to the 
point you would write to the drive) for whichever drive you are going to spoof as 
the donor drive. 


For instance you have a spare samsung drive you want to test a liteOn key with 
before you erase your LiteOn! (you have already dumped the drive and saved the 


Dummy.bin) 


So you take your samsung, unlock it in accordance with the tutorial! 
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Which would then be in vendor mode ready to write firmware to! 


FimwareTool 32 | DVDKey32 MTK Flash32 | HitachiGDR3120 | 


1/0 Port activate.iso 


-360 Tools 
OxCFOO v 


Beng Sammy Lite-On 
Port Properties UnLock UnLock Erase 


1/0 Address: OxCFOO 


Type: SATA Flash Chip Properties 
Channel: Primary Vendor ID: OxBF 
Postion: Master Device ID: 0xB6 
Device: VIA ¥T6421 RAID Controller Name: SST(SST395F020) 


Size: 262144 bytes 
Drive Properties 
Vendor: Drive in Vendor Mode! 


Type: Parallel flash with Status 0x70 


Name: Flashing Tasks 


Intro / Device ID Outro / ATA Reset 
FAW Rev: 
Reserved: Read Erase Write 


Sending Vendor Intro to port OxCFOO 


Parallel flash found with Status 0x70 


Sending Device ID request to port OxCFOO 
Manufacturer ID: OxBF 

Device ID: OxBé 

Flash Name: SST(SST39SF02Z0) 


Flash Size: 262144 bytes 


< | 


Now go to firmwaretool 32 tab 


Source | inquiry: | Identity | Drive Serial 


= DVDKey 32 | MTKAlash 32 | Htachi GDR3120 


Load your dummy.bin as source — 
decline any auto load ix messages! 


Load target firmware — (you are about to flash a samsung so choose ix firmware 
for a samsung drive) 
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ENGO Mintii Ey ware 45 
Lite-On DG-16D2S 83850 LO83info Extract 


OSIG: PLOS DG-1602S 8385 


Target | inquiry | identify | Drive Sera 


UA ven donate. 


D:\JFBeta.0.1.66(50S)\ Firmware \x 16-samsung bin 


pCO sin 


2 ‘orc 


Samsung TS-HS43A ms28 iXTREME1.6-12x-Fl 
-TS-H9434 
OSIG: TSSTcorpDVD-ROM TS-H943Ams28 


Firmware type is: iXTREME1.6€-12x-FINAL-TS-HS43A 


Leading Source File D:\BACKUPS - my xbox\Durmy.bin 

Inquiry string found 

Identify string found 

DVD key found @ OxA030 key is 61DBCE9297809A349FAF1334FFAB118A2 
Firmware is a Lite-On Dummy OSIG: 

Firmware type is: LO83info Extract 


Now click Spoof Source to Target! 


Notice the difference in the target firmware now! 
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> 


4 


Firmware Tool 32 | DVDKey 32_|_MTKAlash 32_ | Hitachi GDR3120 


| Source |Inqury | identify | Drive Sera 


D:\BACKUPS - my xbox\Dummy bin 


Vendor Model Rev Firmware Type DVD Key @ 04030 
Lite-On DG-16D2S 83850 LOS83info Extract 61DBCES29789A349FAF1334FFAB11SA2 


OSIG: PLOS DG-1602S 98385 


Bist ven Donate. 
Target | inquiry | Ment | Drive Seal] 


D:\JFBeta.0.1.66(50S)\Fienware \x16-samsung bin 


Vendor Model Rev Firmware Type DVD Key @ Ox40EC 
Samsung TS-H943A ms28 iXTREME1.6-12@FINAL 61DBCES29789A34SFAF 1334FFAB118A2 
-TS-H9434 


OSIG: TSSTcorpDVD-ROM TS-H943Ams28 [SpoofedAs: PLDS DG-16D2S 8385 


> 


Firmware type is: LO83info Extract 


Spoofing Target 

DVD Key copied to target 

Inquiry string copied from Source to Target 
Identify string copied from Source to Target 
Identify string copied reversed 

Target spoofed as: PLDS DG-16D2Ss 8385 


pa | 


4 


Then all you have to do is Write to the drive the same way as you would for that 
type of drive! In a samsungs case — click Write when on the MTK tab! 


The same method applies to all drives apart from Hitachi which is covered HERE 


CLICK HERE TO RETURN 
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Advanced User Info 


Advanced Ctrl+Fkey Functions 


Ctrl + F1 key, 

Enable context menus 

Ctrl + F2 key, 

Disable context menus 

Ctrl+ F3 key 

To Send Vendor Intro to currently selected Port 

Ctrl + F4 key 

To open iXtreme from firmware folder to Target 

Ctrl + F5 key, 

Set Modder mode backup directory, clear folder to disable it 
Ctrl + F6 key, 

Hitachi read block size 100 --> 2000 (78 and 79 FK models will fail on this) 
Ctrl + F7 key, 

Set working folder in Modder mode... clear all tabs and save log 
Ctrl + F8 key, 

Enable Hitachi Expert Mode! 

Ctrl + F10 key 

To add/update key database from Source tab info 

Ctrl+ F11 key 

To create .csv from key database 

Ctrl + F12 key 

To open key database in Notepad 
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Key Database 
For those who have NOT saved their dumped file and need their key details back. 


Try right clicking on source box and select Open Key d/b. 


FirmwareTool 32 | MTK lash 32_ | _DVDKey 32|- Hitachi GDR3120 


Source | inquiry | Identify | Drive Seral User Guide 


Vendor Model Rev Firmware Type DVD Key @ Key 


OSIG: 


Load f/w 


Firmware 
| = Clear Source 
- Update d/b 
Sa [PPE aT Open Ti 
| Target | Inquiry | Identify | Drive Serial | Open Key d/b 
History 
Manual 
| Vendor Model Rev Firmware Type DVD Key @ Spoofing 


| OSIG: Save to File 


JungleFlasher 0.1.69 Beta 
Session Started Wed Dec 09 00:51:17 2009 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 

Found 0 Com Ports. 
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Blanked out for obvious 
reasons! 


20 
22 
23 
24 
25 
26 
27 
28 
29 
30 
31 
32 
33 


Vendor Model Rev Firmware Type 

Samsung TS-H943A ms28 iXTREME1.61-12x-FINAL-TSÍ  Bianked out for obvious reasons! | 
OSIG: TSSTcorpDVD-ROM TS H943Ams28 Spoofed As: 

Created: Tue Nov 03 23:26:01 2009 Last Updated: Wed Nov 04 07:06:11 2009 G 


J:ABACKUPS - my xbox\my original xbox 
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Registry Settings 


Only really for troubleshooting and debugging and should only be attempted by those 
confident enough to play about in the systems registry settings 


Click Start, click run, type regedit and press enter 
Navigate to HKEY_CURRENT_USER 
Click on JungleFlasher 


You will see something similar to this: 


a 
a Registry Editor i 
File Edit View Favorites Hel 


4-7 Computer Data 
>» J) HKEY_CLASSES ROOT ab) (Default) (value not set) 
ah HKEY_CURRENT_USER ab) AdvView 
it pay oaa 
ab) DoCom 


b- J} Control Panel ‘ 
~J} Environment ab) DoDevID 


; F FUDC a} DoDrives 
>» J) Identities aN Dan 
> JF KeyDB 28) DoUSBOnly 
[Ji JungleFlasher Se) HitAPi 
- }) Keyboard Layout »| HitRev 
~J} Network ab) HitTran 
> Jl Printers ab) 10Port 
>=} Software Left 
> aJ} System ab) Mods 
bJ} Volatile Environment ab] OnlyDummy 
> 2 HKEY_LOCAL_MACHINE lab) ScsiPorts 
> «jb HKEY_USERS ab) Top 
> p HKEY_CURRENT_CONFIG ab) ViaPortsOnly 


ab) Writekey 
ab) Xswitch 


Computer\HKEY_CURRENT_USER\JungleFlasher 
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e Adview - Remembers whether Advanced View was selected or not 
° BackupFolder — Contains the location set for backup folder for modder mode (blanked if modder mode not set 
° COMPort - Remembers last COM Port selected, number represents position in drop down menu 
° Delay32 — timed delay between clicking dvdkey32 and running the commana, to allow time to probe r707 (milli-seconds) 
° DoCom - Enumerates comports, for debug use only 
° DoDevID — Will send Intro if drive reports as in Vendor Mode 
° DoDrives - Enumerates drive letters, for debug use only 
° DolO - Enumerates | / O ports, for debug use only 
° DoUSBOnly — Selects USB only option 
° HitAPi — Remembers if WinAPi is selected (1 yes, 0 no) 
e HitRev — Remembers last drive revision selection 
e HitTran - Remembers last Tranfer Method selection 
e lOPort - Remembers last IO Port selected, number represents position in drop down menu 
° Left - Remembers postion of JungleFlasher window (left hand side) 
. Mods — Counter for CTRL + F7 operations 
° OnlyDummy — Remembers if Dummy.bin only is enabled 
° ScsiPorts - enumerate SCSlAdapter IO ports also (NON-IDE) 
° Top - Remembers postion of JungleFlasher window (Top 
e ViaPortsOnly - enumerate only Via IO ports, for safety (Value 1) Lists all if removed or Value 0 
° WriteKey — Allows the ability to write the key Only from context menu 


e Xswitch — Remembers if USBxtractor switch is enabled 


In addition to the above registry settings — The key database is also stored in 
registry! 
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The Jungleflasher Key Database 


So you know about the all-important KEY? The one that every tutorial about 
xbox360 drive flashing tells you to SAVE, WRITE DOWN, EMAIL IT TO YOURSELF! 


Well the exceedingly clever guys from Jungleflasher have been helping you out 
with this since version 0.1.74. Yet somehow very few people know about this 
fantastic addition. 


The JF (JungleFlasher) key database (dB) is a store of all (locally) dumped keys 
whilst using JF on that particular PC. This dB is only kept on the PC the keys are 
dumped on. The dB itself is held within your pc’s registry (shown below) 


Gow (TITS KV UREDESe EE 


File Edit View Favorites Help 


a | Name Type Data 


a -JE Computer 
== | ab) (Default) REG_SZ (value not set) 
5 


J Console 
J Control Panel 
J DefaultScope 
J Environment 
[B Eupc 


41 jo JF KeyDB 
ME 


Ji Serlist 


J Keyboard Layout 
Ji Network 

| Printers 

J Software 

Ji System 

J Volatile Environment 
J} HKEY_LOCAL_ MACHINE 
Computer\HKEY_CURRENT_USER\JF_KeyDB 


) 


To see the information shown above you simply run “Regedit” from the “Run line’ 
in start menu, and then select HKEY_CURRENT_USER 


“What does the JF KeydB do for me?” 
1. Automatically saves every key dumped using JF 


2. Allows you to search the KeydB for a working key for any drive you attach 
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3. Will create a dummy.bin from the info in the KeyaB if it verifies a key 
against a drive. 


4. Gives you piece of mind — you lost the original dump, it'll be in the dB! 


In Short! — If you used JF to dump a drive on the same PC, re-flashing the drive 

becomes incredibly easy! (No need to MRA LiteOn drives more than once!) You 

no longer need to have a complex way to track all the drives you flashed to be 
able to locate original firmwares. 


How do | take advantage of this phenomenal feature? 


CLICK HERE TO RETURN 
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PMT Probe (Non-Cap) or CK Probe 3 


The PMT Probe is designed to be able to allow you to dump the Key from ALL Phat 
LiteOn without resorting to MRA. 


This method works regardless of current FW on the drive. 
In the following example — I use the X360USB Pro for my SATA connection 
— This is NOT a pre-requisite — 
If you have a currently working SATA setup — it will work just as well 
So select your I/O port as Normal 


You will notice a new Button “PhatKey” 


r -m 
< JungleFlasher 0.1.79 Beta scj jt 


|| MTK Flash 32 | Hitachi GDR3120_|_ IRC Channel 3 
o 


HRNIEC 


USB Only VIA ports Only Additional functions 
~ [22] Include non-IDE Ports [7] Dummy bin Only 


Xecuter 
Presents 
The Hottest 
Product of 


XECUTER X360USB PRO 
ne 2011! 
5 . 


ive Properties : Status: 
el No Drive Detected! [Prater] | SimKey | | 


[ DvDKey32 | | DummyGen | | 83 keyfile | 


JungleFlasher 0.1.79 Beta (207) 
Session Started Sun Feb 20 15:14:40 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 


portio32.sys Driver Started, thanks Schtrom ! ser 
X360USB PRO detected, Version 0.19 OX360USR iw 


Found 12 I/O Ports. 
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Using the PMT 


With drive powered on and showing in drive properties, click refresh ([...]) 


Hitachi GDR3120 


Additional functions | 
Include non-IDE Ports |v v 


Port Properties Refresh Drive Properties 


VO Address: 0x0000 


XECUTER X360USB PRO 
( Ver 0.19) 


JungleFlasher 0.1.79 Beta (207) 
Session Started Sun Feb 20 15:14:40 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32-.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 


Found 12 I/O Ports. 


Notice the drive being identified! 


Device. XECUTER X360USB PRO 
(Ver 0.19) 


Drive Properties 
Vendor: 


Reserved: 
DVD Key: 


portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 

Found 12 I/O Ports. 
Found 0 Com Ports. 


Found 11 windows drives C: D: 
Found 2 CD/DVD drives F: O, 


@X360USB Rw 


Drive is Lite-On.. 
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Now press the “PhatKey” Button 


FimwareTool 32_| DVDKey 32 | MTK Fash 32 | HitachiGDR3120_ | IRC Channel_| 


ie) 
Q ` 
ARPA TTC Mere eS TTT 


Compatible 
ZW with Xbox 360 
DVD drives 
Liteon & 


å Hitachi (SLIM) 
XECUTER X360USB PRO 
(Ver 0.19) 


VO Port USB Only Œ] VIA ports Only [E Additional functions | 


0000 ~ (£)  incudenon-DE Ports 7 
Port Properties 


PLDS 
DG-16D2S 
9345 


:  OCADA2D610CG93691000 
DVD Key: Not Found : 


portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 


Found 12 I/O Ports. 

Found 0 Com Ports. 

Found 11 windows drives C: D: E: F: H: I: K: L: M: N: O: 

Found 2 CD/DVD drives F: 0: BX360i tam 
ET STPRO 


Drive is Lite-On.. 


To resend the command you should click Yes. 
Power off the drive... Probe MPX01... Then power back on. 


Press Escape to cancel. 


Please read this carefully. Then click YES 
Switch 3.3v inline switch OFF 


Probe the point MPX01 (shown below) 


Page 180 of 272 


Things not going as expected? — Read the FAQ’s 


MT1i319L 


2-ANSI 
36F ~ 


SXCABLZL61I00AA 


Things not going as expected? — Read the FAQ’s 
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Switch 3.3v inline switch ON again 


This message should appear in log window 


L 


PhatKey extraction failed! 


Drive is Lite-On.. 
Drive is Lite-On.. 


Sending Vendor Intro to port 0x0000 
Status 0x51 


Re-sending Vendor Intro: 


Serial flash found with Status 0x52 


As soon as you see status 0x52 appear — lift the probe off from the point 


Within a few seconds this should appear 


à Extract complete ! 


= To continue, you must: 


Ensure probe is removed.. Power Off Drive... Wait 5 seconds... 
Power On... then press OK 


Again read it carefully, (note: the 5 sec timing not required) 
Switch 3.3v switch OFF then ON again. 
Then Press “OK” 
IF all has gone well 


You will see the save box appear to save your Dummy.bin 
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Click “SAVE” 


Search JFBeta 


Organize v 


New folder 


*| Documents 
Downloads 


(| Pictures 
f Videos 


e@ Homegroup 


1 Computer 
& Local Disk (C:) 
& DVD RW Drive (D 


© OLD win7 (E) 
a DATA (F:) 
a Local Disk (G:) 


a 


Name 


D Firmware 

|_| BENQ-OFW.bin 
|_| Dummy.bin 
| Hit-OFW.bin 
|) Identify.bin 

|_| Inquiry.bin 


| Key.bin 
|] SAM-OFW.bin 
|) Serial.bin 


Date modified 


04/03/2011 20:26 
04/03/2011 21:46 
02/03/2011 12:28 
30/01/2011 13:48 
02/03/2011 12:28 
02/03/2011 12:28 
02/03/2011 12:28 
04/03/2011 21:32 
02/03/2011 12:28 


Type 

File folder 
BIN File 
BIN File 
BIN File 
BIN File 
BIN File 
BIN File 
BIN File 
BIN File 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


———> c a) 


If this is what you wish to do click “YES” 


This will as normal take you to the Firmware Tool 32 tab, with your Dummy.bin 
loaded as source and the target Firmware loaded and spoofed with your drives 
details. 
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From here the Jungleflasher procedure is identical to the previous versions 


Ensure the 2 keys match each other — then proceed to erase and write your drive. 


FimwareTool 32 | DVDKey 32 | MTK Flash 32 | Hitachi GDR3120 | IRC Channel 


HATAN Lares eS TTT 


C:\jungleflasher Dummy bin 


Compatible 
endian’ Medial Rev Firmware Type voke A090) i 
LiteOn DG-16D2S 93450C Phatkey extract F8F6DOASC49AC7CD715326092E6118E4 a 


DVD drives 
OSIG:[PLDS DG-16D2S 9345] Hitachi, 


Samsung, 


Advanced View p B eons tiene) 


oot source to target nate * 
Copy Key, Inquiry, Identify hd serial from Source to Target Benq & Liteon 
Target = (FAT) 


D:\JFBeta.0.1.69\Firmware\LTPlus-934v 1.1 bin 


Vendor Model Rev Firmware Type DVD Key @ nma 
Lite-On DG-16D2S 93450C LT-Plus 1.1 F8FEDOASC49AC7CD715326092E6118E4 


OSIG:[PLDS DG-16D2S 9345] 


Firmware Osig: [PLDS DG-16D2S 

Firmware is: LTI-Plus 1.1 . 
Spoofing Target Price 
DVD Key copied to target $59 9 5 
Inquiry string copied to Target ° 
Identify string copied to Target 


Serial data copied from Source to Target AX360i -= m 
NST IPRO} 


No Calibration data in source 


CLICK TO CONTINUE TO ERASE & WRITE SECTION 
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PMT Probe (with capacitor) 


The PMT Probe is designed to be able to allow you to dump the Key from ALL Phat 
LiteOn without resorting to MRA. 


This method works regardless of current FW on the drive. 
In the following example — | use the X360USB Pro for my SATA connection 
— This is NOT a pre-requisite — 
If you have a currently working SATA setup — it will work just as well 
So select your I/O port as Normal 


You will notice a new Button “PhatKey” 


r 
| gA JungleFlasher 0.1.79 Beta e= 


|| MTK Flash 32 | Hitachi GDR3120_|_IRC Channel 


VO Port USB Ony ©] VIA ports Only Additional functions 
&0000 ë ě ~ Include non-DE Ports [7] Dummy bin Only 


Port Properties Refresh Drive Properties 
VO Address: 0x0000 
USB 


Primary 


XECUTER X360USB PRO 
(Ver 0.19) 


ive P 7 
Vendor: No Drive Detected! 


[__Dummy from KeyDB | [ _ Dummy fromixtreme _ | 


JungleFlasher 0.1.79 Beta (207) 
Session Started Sun Feb 20 15:14:40 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 


Found 12 I/O Ports. 
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Using the PMT 


With drive powered on and showing in drive properties, click refresh ([...]) 


MTK Flash 32 | Hitachi GDR3120 


Additional functions | 


v 


Port Properties Refresh Drive Properties 


VO Address: 0x0000 


XECUTER X360USB PRO 
(Ver 0.19) 


JungleFlasher 0.1.79 Beta (207) 
Session Started Sun Feb 20 15:14:40 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 


Found 12 I/O Ports. 


Notice the drive being identified! 


Device: XECUTER X360USB PRO Drive 
(Ver 0.19) 
Key: 
Vendor: PLDS 


DG-16D2S PhatKey SlimKey LO83info 


ae [_ DvDKey32_| ( DummyGen | [ 83 keyfie | 
Reserved: — 0CA0A2D610CG93691000 


amie NotFound £ [Dummy from KeyDB } l Dummy from iXtreme | 


portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 


Found 12 I/O Ports. 


Found 0 Com Ports. 

Found 11 windows oe I: E: L: M: N: O: 

Found 2 CD/DVD drives F: O, X360! tram 
PST STPRO 

Drive is Lite-On.. 
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Now press the “PhatKey” Button 


FimwareTool 32_| DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel_| 


ie) 
Q ` 
ARPA TTC Mere eS TTT 


Compatible 
ZW with Xbox 360 
DVD drives 
Liteon & 


å Hitachi (SLIM) 
XECUTER X360USB PRO 
(Ver 0.19) 


VO Port USB Only Œ] VIA ports Only [E Additional functions | 


0000 ~ (£)  incudenon-DE Ports 7 
Port Properties 


PLDS 
DG-16D2S 
9345 


:  OCADA2D610CG93691000 
DVD Key: Not Found : 


portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.19 


Found 12 I/O Ports. 

Found 0 Com Ports. 

Found 11 windows drives C: D: E: F: H: I: K: L: M: N: O: 

Found 2 CD/DVD drives F: 0: BX360i tam 
ET STPRO 


Drive is Lite-On.. 


To resend the command you should click Yes. 
Power off the drive... Probe MPX01... Then power back on. 


Press Escape to cancel. 


Please read this carefully. Then click YES 
Switch drive power OFF 


Probe the point MPX01 (shown below) 
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MT1i319L 


2-ANSI 
36F ~ 


SXCABLZL61I00AA 


Things not going as expected? — Read the FAQ’s 


vA noma me i 


yi Bees = oy 
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Switch Drive Power ON again 


This message should appear in log window 


PhatKey extraction failed! 


Drive is Lite-On.. 

Drive is Lite-On.. 

Sending Vendor Intro to port 0x0000 
Status 0x51 

Re-sending Vendor Intro: 


Serial flash found with Status 0x52 


As soon as you see status 0x52 appear — lift the probe off from the point 


Within a few seconds this should appear 


@ à Extract complete ! 


To continue, you must: 
Ensure probe is removed.. Power Off Drive... Wait 5 seconds... 
Power On... then press OK 


Again read it carefully, 
Switch drive power OFF 
Wait 5 seconds 
Switch drive power back ON 
Then Press “OK” 


IF all has gone well 
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You will see the save box appear to save your Dummy.bin 


Click “SAVE” 


= | Search JFBeta E7 


[À Documents Name Date modified Type 
6) Downloads 
a Music 

E] Pictures 
B& Videos 


J Firmware 04/03/2011 20:26 File folder 
|_| BENQ-OFW.bin 04/03/2011 21:46 BIN File 
_| Dummy.bin 02/03/2011 12:28 BIN File 
|_| Hit-OFW.bin 30/01/2011 13:48 BIN File 
Identify.bin 02/03/2011 12:28 BIN File 
{| Inquiry.bin 02/03/2011 12:28 BIN File 
|_| Key.bin 02/03/2011 12:28 BIN File 
|_| SAM-OFW.bin 04/03/2011 21:32 BIN File 
| Serial.bin 02/03/2011 12:28 BIN File 


=| 


LJ 


a Homegroup 


jE Computer 
& Local Disk (C:) 
& DVD RW Drive (D 
© OLD win7 (E) 
ca DATA (F:) 
© Local Disk (G:) 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


> Ce) Geo 


If this is what you wish to do click “YES” 
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Things not going as expected? — Read the FAQ’s 


This will as normal take you to the Firmware Tool 32 tab, with your Dummy.bin 
loaded as source and the target Firmware loaded and spoofed with your drives 


details. 


From here the Jungleflasher procedure is identical to the previous versions 


Ensure the 2 keys match each other — then proceed to erase and write your drive. 


E 
ZA JungleFlasher 0.1.79 Beta oc =n ES 


DVDKey 32 | MTK Fash 32 | HitachiGDR3120_ | IRC Channel 


WANTS co 


C:\ungleflasher\Dummy bin 


Vendor Model Rev Firmware Type 
Lite-On DG-16D2S 93450C Phatkey extract 


OSIG:[PLDS DG-16D2S 9345] 


Compatible 


DVD Key @ A030 3 
F8F6D0A9C49AC7CD715326092E6118E4 with Xbox 360 
DVD drives 


Hitachi, 


Samsung, 
Benq & Liteon 


(FAT) 


D:\JFBeta.0.1.69\Fimware\LTPlus-934v1.1.bin 


Vendor Model Rev Firmware Type 
Lite-On DG-16D2S 93450C LT-Plus 1.1 


OSIG:[PLDS DG-16D2S 9345] 


DVD Key@ nia 
F8FEDOASC49AC7CD715326092E6118E4 


Firmware Osig: [PLDS DG-16D2S 
Firmware is: LI-Plus 1.1 

Spoofing Target 

DVD Key copied to target 

Inquiry string copied to Target 
Identify string copied to Target 

Serial data copied from Source to Target 
No Calibration data in source 


Price 


$59.95 
@X360USBRG 


CLICK TO CONTINUE TO ERASE & WRITE SECTION 
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Things not going as expected? — Read the FAQ’s 


Badflash Recovery Using X360USB Pro of Samsung, 
BenQ & LiteOn Drives. 


This method is to recover from those horrible moments (when something has 
gone wrong during flashing/erasing procedure. You know the ones — You 
forgotten to plug in AV cable and your Xbox powered off (even though we told 
you not to use Xbox for power) or your child has stood on a power cable and 
yanked it out the wall, you forgot to pay the electricity and have been cut off! 


So get it all up and running and now the drive doesn’t show up on the port where 
it was previously, eject does nothing (don’t even bother plugging it into console) 
it’s Bad Flashed! 


With the X360USB Pro recovery works very simply 99% of the time (sometimes 
Samsung can be a pain — but usually it works in the end!) 


Unplug your X360USB Pro and power off the drive. Close JungleFlasher. 


Reopen JungleFlasher, plug the X360USB Pro back in — select it from the IO Port 
list (if it hasn’t automatically done it for you). Power on the drive! 


So you clicked refresh, the drive is powered on and nothing shows up 


Firmware Tool 32 | DVDKey 32 | MTK Hash 32 | Hitachi GDR3120 | IRC Channel 


VO Port USB Only [F] VIA ports Oniy activate.iso 
360 Tools 
00000 Include non-IDE Ports | 
Beng Sammy - 
Port Properties | UnLock | | UnLock | lto On Erase 
VO Address: 0x0000 Ce 
Type: USB Flash Chip Properties 
Channel: Primary Vendor ID: 
Postion: Master Device ID: 
Device: XECUTER X360USB PRO Name: 
( Ver 0.17) i 
Size 
Drive Properties Type: 
Vendor: No Drive Detected! 
Name: Flashing Tasks E 
| r 
ee | Intro / Device ID | | Outro / ATA Reset 
Reserved: | Read | | Erase | | Write 
DVD Key: 
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Things not going as expected? — Read the FAQ’s 


Then select Intro / Device ID button 


omman O OOOO o ë ă 


FimwareTool 32 | DVDKey32 | MTK Fash 32 | Hitachi GDR3120 _|_IRC Channel 


mt: 
fo) 
pee activate iso YAPITTA EETA 
USB Only [V] VIA ports Only - 360 Tods 
0000 X m] Include non-IDE Ports 
; Beng Sammy Lite-On Erase 
Port Properties UnLock | UnLock | Connect any 
VO Address: 0x0000 BS 
RA me E E SATA device 
Channel: Primary Vendor ID: to any 
Postion: Master Device ID: PC or laptop 
Device: XECUTER X360USB PRO Name: 
(Ver 0.17) via USB 
Size: 
Drive Properties Type: 
Vendor: No Drive Detected! 
hae Tasks 
pea Outro / ATA Reset 
Reserved: Read Erase 
DVD Key: 


JungleFlasher 0.1.79 Beta (207) 
Session Started Wed Mar 02 00:11:07 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
X360USB PRO detected, Version 0.17 


Found 1 1/0 Ports. O | @PX36GUSB Ema 


Found 0 Com Ports. 
Found 9 windows drives C: D: E: F: G: H: I: J: K: 


If you wish to resend the command you should click Yes. 
Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click YES then Power on the drive again. 
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Things not going as expected? — Read the FAQ’s 


At this point (dependant on which drive) you should be faced with the drive in 


vendor mode (with appropriate status for drive type). 


Flash Chip Properties Flash Chip Properties 
Vendor ID: OxC2 Vendor ID: OxEF 4 
Device ID: 0x11 Device ID: 0x11 


Winbond/NEX(W25P20/NX25P20) 
262144 bytes 
Serial flash with status 0x72 


MXIC(MX25L2005) 
262144 bytes 
Serial flash with status 0x72 


LiteOn 


Flash Chip Properties 
Vendor ID: OxC2 
Device ID: 0x11 

: MXIC(MX25L2005) 


262144 bytes 
Serial flash with status 0x73 


Vendor ID: 0xBF 
Device ID: OxB6 
Name: SST(SST39SF020) 
262144 bytes 
Parallel flash with Status 0x70 


Samsung 


Now simply proceed at the part of the flashing process you were at when the 
writing of your drive went wrong! 


(Remember you must load your previously dumped Dummy.bin / OFW.bin as 
source and auto-load your iXtreme firmware as target.) 


CLICK HERE TO PROCEED 
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Things not going as expected? — Read the FAQ’s 


Samsung Drives Using PMT or CK Probe 3 When normal bad-flash 
won’t work 


For those awkward moments when things just haven’t gone as planned! - There is 
a longer but simple method. 


Utilize the Xecuter Probe 3 or PMT (probe goes to GND) 


Open the drive case and expose the bottom of the PCB 


Then locate the point you need to probe with your PMT/CK Probe 3 


Then load Jungleflasher, ensure you have correct IO port selected! If the drive is 
Bad-flashed it won’t show up even after a port refresh like the example below 
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Things not going as expected? — Read the FAQ’s 


FimwareTool 32_| DVDKey 32] MTK Fash 32 | HitachiGDR3120_|_ IRC Channel 


I/O Port — — activate.iso 
SB ¥] VIA ports Only [_] 
Oriy [E] MA pota Ory C] 360 Tools 
0000 Include non-IDE Ports [7] 
Beng Sammy 
VO Address: 0x0000 ee 
Type: USB Flash Chip Properties 
Channel: Primary Vendor ID: 
Postion: Master Device ID: 
Device: XECUTER X360USB PRO Name: 
( Ver 0.17) s 
Size: 
Drive Properties Type: 
Vendor: No Drive Detected! 
iene Flashing Tasks 
one [_ intro / Device ID | [ Outro /ATAReset | 
a 
DVD Key: 
portio32.sys Driver Started, thanks Schtrom ! a 


Found 10 I/O Ports. 

Found 0 Com Ports. 

Found 9 windows drives C: D: E: F: G: H: I: J: K: 

Found 1 CD/DVD drives D: p 


XECUTER X360USB PRO attached. 


PortIO unloaded. 


Then select Intro / Device ID button 


lä 
omga O U 


FimwareTool32_| DVDKey32 | MTK Rash32 | HitachiGDR3120_|_ IRC Channel | 


RRT ie) 
USB Only [V] VIA ports Only |_| n WROTTE 


Include non-IDE Ports [7] 


Connect any 
SATA device 
to any 
PC or laptop 


a aaa PRO > via USB 


JungleFlasher 0.1.79 Beta (207) 
Session Started Wed Mar 02 00:11:07 2011 


e 
This is a 32 bit process running on 4 x 32 bit CPUs y .95 
X360USB PRO detected, Version 0.17 


Found 1 I/O Ports. @X360USB PRO 


Found 0 Com Ports. 
Found 9 windows drives C: D: E: F: G: H: I: J: K: 
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Things not going as expected? — Read the FAQ’s 


Then power off your drive — you will be asked for confirmation 


MTK Vendor Intro failed 


Click YES and probe the point on the board 


Power on the drive and watch Jungleflasher window for status 0x70 
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Things not going as expected? — Read the FAQ’s 


E 
<j@ JungleFlasher 0.1.79 Beta 


FimwareTool 32 | DVDKey 32 


MTK Flash 32 


WO Port 
ooo ë ~ (i, 
Port Properties 

VO Address: Ox0000 


USB 
Primary 
Master 


(Ver 0.17) 


USB Only [V] VIA ports Only 


Include non-IDE Ports 


XECUTER X360USB PRO 


HitachiGDR3120 | IRC Channel 


mts 


activate.iso TUCO tenes amuk 


Sammy 


Sa, | [neoncm] 


CS 


Vendor ID: OxBF 
Device ID: OxB6 


SST(SST39SF020) 
262144 bytes 


Parallel flash with Status 0x70 


Drive Properties 
Vendor: 


Name: 


Drive in Vendor Mode! 
Hashing Tasks 


[Intro / Device ID] Í Outro/ATAReset | 


Wie | 


Parallel flash found with Status 0x70 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxBF 

Device ID: OxBé 

Flash Name: SST(SST39SF020) 

Flash Size: 262144 bytes 


@X360USBRG 


4 unlia) 


Immediately lift the probe — then Continue with the correct procedure for what you were doing! 


If you had bad-flashed it — then 


Write your target firmware. 


If you were unlocking — proceed to the 


Reading of your firmware. 
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Things not going as expected? — Read the FAQ’s 


Benq Badflash Recovery 


Badflash can happen if your PC freezes midway through flashing, your xbox 
powers off during flashing (you should have had the A/V cable inserted), if you 
took the 13146 update with custom firmware or a spoofed drive, or for other 
reasons. 
If things haven’t gone as planned with your Benq flash, then you might need 
badflash recovery methods outside of a simple “intro/device id, yes, power cycle.’ 


This version of badflash recovery should NOT be needed for VIA 6421 cards, but 
may be necessary for many onboard setups and use of the x360usb pro. 


You will need a Xecuter Probe 3, PMT, or a GND probe of your own building 
(as the switch of the Probe 3/PMT isn’t required). 


Open the drive case and expose the bottom of the PCB. 


Locate MPX01 as shown below, as it is unlabeled on the PCB. 
If your MPX01 point is covered in epoxy, you can use a soldering iron on low heat 


MTis2yv=a 
0729-AUBL 
IZD20014 


. OQO 
t š 
Pa = 
> 
j aS 
Das 
rop eS 
i $ 
> 
> 
< 
"> 
oud 
af SS 
a 
% 


ch 
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Things not going as expected? — Read the FAQ’s 


Load up Jungleflasher, and ensure you are using the correct IO port. The drive will 
NOT show up in JF if the drive is badflashed, even if you refresh the port. 


Power off your drive. 
NOTE: This power off is done with the switch on the ck3 or by unplugging the drive from the xbox. 
(The Probe 3/PMT switch will NOT suffice.) 


Press Intro/Device ID. 


“| Hitachi GDR3120 | IRC Channel | 


|_FimwareTool 32 | DVDKey 32 | 


activate.iso 

VO Port USB Only [©] VIA ports Only 360 Tools 

0000 ~ [k] Include non-IDE Ports | ETER || | P | | Lite-On | | Slim 
enh UnLock | | UnLock | | Erase | | UnLock 
VO Address: 0x0000 ZW 

Type: USB Inir zi 

Channel: Primary bs zs 

Postion: Master pesca a 

Device: XECUTER X360USB PRO ome: 

({ Ver 0.18) Size: 

Drive Properties ie 


Vendor: No Drive Detected! 


Flashing Tasks 
Name: => [ Intro /Device ID} | Outro/ATAReset_] 
F/W Rev: 


Reserved: [ Red | | Eese | | White | 


JungleFlasher 0.1.84 Beta (250) 
Session Started Mon Jul 18 02:33:08 2011 


m 


This is a Wow 64 process running on 4 x 64 bit CPUs 
X360USB PRO detected, Version 0.18 


portioé4.sys Driver Installed 
portioé4.sys Driver Started, thanks Schtrom ! 
Found 11 I/O Ports. > 


A popup will show when the Intro command fails. 
E 
MTK Vendor Intro failed B j 


( > ) F you wish to resend the command you should click Yes. 
‘Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click YES and probe MPX01 on the PCB with the Probe 3 or PMT. 
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Things not going as expected? — Read the FAQ’s 


Power on the drive and watch in Jungleflasher for status 0x73. 


[_FimwareTool 32_| DVDKey32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel 


activate. iso 
VO Port USB Only [E] VIA ports Only E] 360 Tools 
@0000 ~ [k] Include non-DE Ports [E] | p | | Fiala | | = | Sim 
Pott Properties UnLock UnLock Erase UnLock 
VO Address: 0x0000 Ce 
lee USB Flash Chip Properties 
Channel: Primary fog Ee 
Postion: Manta Device ID: 0x11 
Device: XECUTER X360USB PRO secrete 
(Ver 0.18) ize: 262144 bytes 
Dive Propatics Serial flash with status 0x73 
Vendor: Drive in Vendor Mode! mA 
nama; [intro / Device ID] ( Outo ZATA Reset | 
F/W Rev: 
Reserved: | Read | | Erase | | Write | 
DVD Key: Phat @ Slim 
Re-sending Vendor Intro: a 


Serial flash found with Status 0x73 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxC2 

Device ID: 0x11 

Flash Name: MXIC(MX25L2005) 

Flash Size: 262144 bytes 


When you see 0x73, immediately lift the probe. If your flash chip properties are 
shown similar to above, you can continue to the normal section of the tutorial 
and proceed to your next step. 


However, if your flash chip properties are not shown and you get “n/a” for size, 
you will not be able to read or write firmware to the drive. Often, simply pressing 
“Intro/Device ID” will fix the problem and Jungleflasher will return good flash chip 

properties. 


CONTINUE 
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Things not going as expected? — Read the FAQ’s 


Slim Lite-on Badflash Recovery 


If things haven’t gone as planned with your Slim Lite-on flash, then you might 
need badflash recovery methods outside of a simple “intro/device id, yes, power 
cycle.” 


NOTE: most often only needed for semi-compatible chipsets (like VIA 6421 and some onboards). The 
X360USB Pro should almost always be able to get Slim Lite-ons into Vendor Mode without probing. 


Badflash can happen if your PC freezes midway through flashing, your xbox 
powers off during flashing (you should have had the A/V cable inserted), or for 
other reasons. 


You will need a Xecuter Probe 3, PMT, or a GND probe of your own building 
(the switch of the Probe 3/PMT isn’t required). 


Open the drive case and expose the bottom of the PCB. 

E —___ Locate MPX01, it is labeled on the PCB. 
yna S igen C0676060 z 

3 ~~ E } ( 


ee sarny 


Gzy Icy SCY 
£99999 129 


Cur 47094 
03xB3C818400 


T 
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Things not going as expected? — Read the FAQ’s 


Load up Jungleflasher and make sure you have the correct IO port selected. If 
your drive is badflashed it will NOT show in Jungleflasher, even after a port 
refresh. 


Make sure the “Slim” button is ticked. Then press Intro/Device ID. 


[_FimwareTool 32 | DVDKey32 | MTK Fash32 | HitachiGDR3120 | IRC Channel | 
ty activate.iso 
a USB Only Z] VIA ports Only E 360 Tools 
@0000 ~ [] Include non-DE Ports E] | pE see | | aa | = | 
Pott P 5 UnLock UnLock Erase UnLock 
IO Address: 0x0000 CP 
Tien USB Flash Chip Properties 
Channel: Primary cone 
Postion: Master ee 
Device: XECUTER X360USB PRO : 
(Ver 0.18) Size: 
Drive Pı = Type: 
. = I 
Vendor: No Drive Detected! Flashing Tasks 
Name: (Into /DevicelD_ | [ Outro /ATAReset | 
FW Rev: 
Reserved: [Read | | crse | | wie | 
DVD Key: Phat © @ Slim 
JungleFlasher 0.1.84 Beta (250) 
Session Started Mon Jul 18 02:08:39 2011 
This is a Wow 64 process running on 4 x 64 bit CPUs 7 
X360USB PRO detected, Version 0.18 
portioé4.sys Driver Installed 
portioé4.sys Driver Started, thanks Schtrom ! 
Found 11 I/O Ports. = 


A popup will appear when the Intro command fails. 
Power off your drive (using the ck3 switch or by unplugging the drive from your 
xbox). 


an 
MTK Vendor Intro failed 


á A ) If you wish to resend the command you should click Yes. 
N Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 
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Things not going as expected? — Read the FAQ’s 


Probe MPX01 on the PCB (shown above) 
Press YES 


Power on the drive and watch Jungleflasher for status 0x72. 


[_FimwareTool 32 || DVDKey32 | MTK Fash 32 | HitachiGDR3120_|_ IRC Channel 


: activate.iso 
VO Port USB Only VIA ports Only 360 Tools 
00000 ’ (a) Include non-IDE Ports Beng s Lite-On Slim 

, UnLock UnLock Erase UnLock 

Port Properties 

VO Address: 0x0000 CP 

Fo USB Flash Chip Properties 

Channel: Primary Ms Ae WAS 

3 Device ID: 0x11 
Postion: Master 
Device: XECUTER X360USB PRO eee a alc 
( Ver 0.18) 262144 bytes 

: : Serial flash with status 0x72 

Drive Properties 
à Pane i 

Vendor: Drive in Vendor Mode! TT 

Name (Into /Device ID | [ Outro ZATA Reset | 

Fiw Rev: 

Reserved: [Read | | Eese | | White | 

DVD Key: Phat © Slim 

Re-sending Vendor Intro: a 


Serial flash found with Status 0x72 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: Winbond/NEX(W25P20/NX25P20) 
Flash Size: 262144 bytes 


When 0x72 appears, immediately lift the probe. \f good flash chip properties 
appear then continue to the correct procedure to whatever you were doing. 


If you do not get flash chip properties, and get “n/a” for size, check to make sure 
that the “Slim” button is ticked. 


NOTE: If “Slim” is ticked, and you still get bad flash chip properties, make sure that you are 
using an original Slim Lite-on PCB. If the PCB has been modified with an Xecuter Pro Unlock 
Kit or is an Xecuter Unlock PCB, then Jungleflasher must have “Phat” ticked. 


CONTINUE 
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Things not going as expected? — Read the FAQ’s 


LiteOn Slim FW Ver. 0225, Locked 0272, 0401, 1071 


Dumping the required drive info is very straight forward. 


First select the DVDKey 32 tab. 


| FimwareTool 32 


MTK Flash 32_| HitachiGDR3120 | IRC Channel. | 


NOTE: Very few chipsets are known to work reliably for 0225 (and subsequent) drives 


(Hence why we are using X360USB Pro) 
Ensure it inquires on the I/O port. 


Click the SlimKey Button 


Firmware Tool 32 


e JungleFlasher 0.1.81 Beta 


If getting Dummy from other drives it 


4| MTK Flash 32 


will show diff properties — i.e. 


VO Port USB Only ©] VIA ports Oni 
@0000 ~ [k] include non-DE Po 
Port Properties 
VO Address: 0x0000 
Type: USB 
Channel: Primary 
Postion: Mast 5 
Device: XECUTER X360USB PRO 
( Ver 0.17) 


Drive Properties 
Vendor: 


Name: 


PLDS 


DG-16D4S LO83info 


Cra ) E 


HRATT eas CTO 


Xecuter 


Presents 


The Hottest 
Product of 


2011! 


FW Rev: 0225 


ADAO 


Reserved: 


DVD Key: 


| Dummy from KeyDB | | Dummy from iXtreme 


| DVDKey32 | [ DummyG| Slim LiteOn - extract Key, build dummy and open. 


JungleFlasher 0.1.81 Beta (223) 
Session Started Mon Apr 04 11:42:32 2011 


This is a 32 bit process running on 2 x 32 bit CPUs 
portio32.sys Driver Installed 

portio32.sys Driver Started, thanks Schtrom ! 
X360USB PRO detected, Version 0.17 


I| Found 3 I/O Ports. 
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Things not going as expected? — Read the FAQ’s 


m 


r > 


A X360UShiRG 


WORLD WIDE SHIPPING 


You will be presented with an option box asking if you wish to send Slim Unlock 


Select NO 


SlimKey 


e Do you wish to send Unlock to Slim 


4 


JungleFlasher will start to grab the key sector and serial data 


# JungleFlasher 0.1.81 Beta 2 ote 


FimwareTool32 | DVDKey32 | MTK Fash 32 _|_ HitachiGDR3120_ |_ IRC Channel k 
SOE 


(©) 
Q r 
VO Port USB Only |] VIA ports Only Com Port Additional functions waNTATOUITACETS 


0x0000 ~ [...] Include non-IDE Ports a Dummy bin Only 


Port Properties Com Port Properties 
WO Address: 0x0000 Port: 


Type: USB Type: 
Channel: Primary Name: 


Master Status: 


XECUTER X360USB PRO Dri 
( Ver 0.18) ie 
Key: 
Drive Properties Status: 
Vendor: Drive in Vendor Mode! 


Name: PhatKey SlimKey LOB83info 
F/W Rev: 
Reserved: 


DVDKey32 DummyGen 83 key file 


Dummy from KeyDB Dummy from iXtreme 


00 
00 
00 


aD KE 
00 


RN on 
verified, Thanks C4eva B Z X360USB CU 
‘Grabbing Key sector: 


me a | 


You will be faced with this 
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Things not going as expected? — Read the FAQ’s 


- 
MTK Vendor Intro failed nn 


E ) If you wish to resend the command you should click Yes. 
bhed Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click Yes the power off then on again 
Once dump has completed it will also verify the Key 


(as shown below) 


Key: Giiebtetasesenpenreeeenwererteres is verified, Thanks C4eva 
Grabbing: Keay sector: So 42% 

Key Sector verified. 

Grabbing Serial info: .......- 


Drive is Slim Lite-On.. 


Key found in KeyDB at record (21 - slimdemo) 
Vev Ls BRRR 


Jungleflasher will then populate this information and create a Dummy.bin, 


You will be asked to Save the file (as always — Please do so!) 
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Things not going as expected? — Read the FAQ’s 


E Pictures 
qe Music 
[3g Recently Changed 
p Searches 
& Public 
Folders “A 
File name: X 
Save as type: [Firmware Images (*.bin) a 
a Hide Folders Cancel 


Firmware Tool 32 tab will be automatically opened and your Dummy.bin loaded 
as source. 


Option 1 : Use a replacement PCB / Pro-kit modified Orig PCB 


Option 2 : Use a spare 9504 PCB (During 13599 Dash update 0272 stock firmware 
is flashed to your PCB and locked ) 


Option 3: Unlocking your PCB (more difficult 
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Things not going as expected? — Read the FAQ’s 


Flashing your Replacement PCB (T-X) or Pro-Kit modified PCB 


You should already have Slimkey’d your drive and obtained a dummy.bin. This 
should be loaded as source and allowed to auto-load iXtreme Firmware as target 


FimwareTool32 | DVDKey 32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel 


OSIG:[PLDS DG-16D4S 0401] 


Source | Inquiry | Identify | Drive Serial Open KeyDb 
C:\Users S LIVI 401\Dummy bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 
Lite-On DG-16D4S 0401 SlimKey Extract a 
à Open Source 
OSIG:[PLDS DG-16D4S 0401] Ganin 
[7] Advd User Guide 
Ensure Keys in both source and target Match =) 
Target Open Target 
Firmware 
F:\JFBeta\Firmware\LTPlus-0401-v1.9.bin 
Manual 
Vendor Model Rev Firmware Type DVD Key @ nia Spoofing 
Lite-On DG-16D4S 0401 LT-Plus 1.9 ae 
Save to File 


Genuine LT plus v1.9 

Drive key @ n/a 

Firmware Osig: [PLDS DG-16D45 0401] 
Firmware is: LT-Plus 1.9 

Spoofing Target 

DVD Key copied to target 

Key Sector copied from Source to Target 
Target is LT - ID strings not copied to Target 


Connect your Replacement PCB 


And select MTK Flash 32 Tab 


Note PCB’s are blank when shipped as are the Pro-kit installed chips 


So Drive properties will NOT show up 
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Things not going as expected? — Read the FAQ’s 


4 ham) 


Ensure you are on the correct I/O Port 


FimwareTool 32 | DVDKey32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel 


activate.iso 
VO Port USB Only [7] VIA ports Only 


360 Tools 
00000 v (m) Include non-IDE Ports Benq Sammy Lite-On 
UnLock UnLock Erase 


Port Properties 
I/O Address: 0x0000 ee Flash Chip P ; 
baie: a Vendor ID: 
Channel: Primary Device ID: 
Postion: Master roe 
Device: XECUTER X360USB PRO Sw 
( Ver 0.18) = 


JungleFlasher 0.1.85 Beta (255) 
Session Started Sun Jul 17 11:53:41 2011 


This is a 32 bit process running on 4 x 32 bit CPUs 
X360USB PRO detected, Version 0.18 


Found 1 I/O Ports. 
Found 0 Com Ports. 
Found 12 windows drives C: D: E: F: G: H: I: K: L: M: O: P: 


Ensure Phat is selected 
Then press Intro / Device ID 


You may get this box appear 
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Things not going as expected? — Read the FAQ’s 


m 


runorna M 


@ F you wish to resend the command you should click Yes. 


Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


oe (eamaten) 


If so, then press Yes and turn drive power OFF then ON again quickly. 


You should now see this. Including a button (0x00) that was previously blank. 


FimwareTool 32 MTK Fash 32 | Hitachi GDR3120 


VO Port USB Only [7] VIA ports Only 360 Tools 
00000 X (ams Include non-IDE Ports |_| Beng Sammy Lite-On 
UnLock | | UnLock | | Erase 
Port Properties 
I/O Address: 0x0000 CP “Flash Chip Properti 
Type: USB Vendor ID: OxEF 
Channel: Praveny Device ID: 0x11 
Postion: Master Winbond/NEX(W25P20/NX25P20) 
Device: XECUTER X360USB PRO 
Serial flash with status 0x72 
Drive Properties 
Vendor: Drive in Vendor Mode! 
Name: 
Fiw Rev: 
Reserved: 


DVD Key: Verified F 


Serial flash found with Status 0x72 


Note: this Button displays the status 


Sending Device ID request to port 0x0000 of the Spi lock. 

Spi Status: 0x00 0x00 = Unlocked 

Manufacturer ID: OxEF 2 

Device ID: 0x11 pays Ox8C = Locked 

Flash Name: Winbond/NEX (W25P20/NX25P20) This is the Lock that M$ employs! = 


Flash Size: 262144 bytes (not the HW switch on the PCB) 
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NOTE: If the button is 0x8C — ensure switch on board is set to wp#1 then press the button to 
unlock the board 


Now press the Write button 


FimwareTool 32 | DVDKey32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


activate.iso 

WO Port USB Only (V| VIA ports Only 360 Tools 
00000 v (aaa) Include non-IDE Ports | pono. | | sot | Lite-On | | a | 
Port Properties 

I/O Address: 0x0000 Ce Flash Chip P T 

pe as Vendor ID: OxEF 

EEE HEN Device ID: 0x11 

ce Name: Winbond/NEX(W25P20/NX25P20) 

Device: XECUTER X360USB PRO . 

Type: Serial flash with status 0x72 

Drive Properties 

Vendor: Drive in Vendor Mode! Flashing Tasks 

Name: Intro / Device ID Outro / ATA Reset 

Fiw Rev: 

Read Erase 
e 
DVD Key: Verified E Phat © © Slim 
Wetting DE 2s occccdcs Cease cd A 


Flash Verification Test ! 
Reading Bank 0: 
Reading Bank 1: 


Reading Bank 2: 
Reading Bank 3: 
Write verified OK ! 


Jungleflasher will proceed to write the firmware that was loaded in target buffer 
on the FirmwareTool 32 Tab. 


Once complete check the log for the Write Verified OK! Message 
Now — Very importantly! 


The original drives should all be locked so you need to ensure your replacement is 
the same! 
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Press the Spi-Lock Status Button 


Currently displaying 0x00 


Flashing Tasks 
Intro / Device ID Outro / ATA Reset 
[Read | [| Emse | ( Wie | 


Phat @ © Slim 


You will see this warning 


Aà This Lock is intended for: 
’ - XECUTER DG-16D4S UNLOCKED PCB 
- XECUTER DG-16D4S PRO INSTALL KIT 


You should not attempt to lock a Phat Lite-on. 
If you do, LO-Erase will fail ! 

You will have no recourse other than to MRA 
the drive to Intro it. 


Click OK to lock the drive 


This sends the command to lock the Spi (just as MS did with 0272 drives on the 
13599 dashboard update) you should see this in the log! 


aS a l De cscs cis ccce anne 
Bamtiiug Bank 22 osc ccscvicwsnce 
Reading Bank 3: ............--..-- 
Write verified OK ! 


Now note the button text has changed to Ox8C 
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Now pressing the Spi-Lock button again will fail to unlock it! (that is exactly the 
way MS expect an original drive to behave!) 


So Ensure you set the switch to WP#=0 


NOTE: If you wish to reflash later, set switch to WP#=1 and pressing the Ox8C 
button will allow unlocking of the Spi. 


Very Important Final Step! 


Press the Outro /ATA Reset Button 
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FimwareTool 32 | DVDKey32 | MTK Hash 32 | HitachiGDR3120 | IRC Channel 


activate.iso 
WO Port USB Only [Z] VIA ports Only [C a 
00000 hd (...] Include non-IDE Ports Beng Sammy Lite-On 
UnLock UnLock Erase 
Port Properties 
I/O Address: 0x0000 CP Flash Chip Properti 
Type: USB Vendor ID 
Channel: Primary Device ID 
Postion: Master TELEN 
Device: XECUTER X360USB PRO ae 
{ Ver 0.18) at 
Type: 
Drive Properties 
Vendor: No Drive Detected! Flashing Tasks 


DVD Key: Verified E Phat @) 


Remding Bawle 22 aesaat 
Meeting Bask 22. cesses ccesccce 
Write verified OK ! 


IMPORTANT! 


After sending Outro / ATA Reset, 
Sending Spi Lock to Port 0x0000 If this is all you see! 
Success ! YOU MUST 


Spi Status: 0x8C 
Sending Vendor Outro to port 0x0000 


press Outro / ATA Reset AGAIN! 


If you do NOT get a Key tested and Verified message in log — Press Outro /ATA 
Reset Button AGAIN 
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Firmware Tool 32 | DVDKey 32 | MTK Ħash 32 | Hitachi GDR3120 | IRC Channel | 


activate.iso 
VO Port USB Only [V] VIA ports Only 360 Tools 
Port Properties 
I/O Address: 0x0000 Ce Flash Chip P 
Type: a Vendor ID: 
Channel: Primary Device ID 
Postion: Master . 
Device: XECUTER X360USB PRO oe 
( Ver 0.18) ze: 
Type: 
Drive Properties 
Vendor: PLDS Flashing Tasks 
Name: DG-16D4S Intro / Device ID Outro / ATA Reset 
FAW Rev: 0401 
Read Erase 
cineca a [ Wie | 
DVD Key: Verified 9 Phat @) © Slim | 


“Success ! 
Spi Status: 0x8C The 2nd one Outros fully and shows 
the drive type and the key 


Drive is Slim Lite-On.. verification. 


This is now Properly Outro'd 
THIS IS VITAL - DO NOT FORGET 
TO DO THIS 


Switch off power to drive, Disconnect and test in your xbox! 


YOU ARE FINISHED — CLICK HERE TO RETURN TO START 
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Using a Spare Unlocked 9504 PCB 


You should already have Slimkey’d your drive and obtained a dummy.bin. This 
should be loaded as source and allowed to auto-load iXtreme Firmware as target 


FimmwareTool 32 | DVDKey32_| MTK Fash32 | HitachiGDR3120 | IRC Channel 


Source | inquiry | Identify | Drive Serial Open KeyDb 
F:\BACKUPS -my xbox\\Black SLIM 0225\Dummy bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ A030 
Lite-On DG-16D4S 0225 = SlimKey Extract TE, 
OSIG:[PLDS DG-16D4S 0225) altar 


ae Se Tn ont =e 


T. = z z = Open Target 
arget | Inquiry | Identify | Drive Serial p 
F:\JFBeta\Fimware\LTPlus-0225-v 1.9.bin 
Manual 
Vendor Model Rev Firmware Type DVD Key @ ma Spoofing 
Lite-On DG-16D4S 0225 LT-Plus 1.9 a 
OSIG:[PLDS DG-16D4S 0225) Save to File 
Genuine LT plus v1.9 a 
Drive key @ n/a 
Firmware Osig: [PLDS DG-16D45 0225] 


Firmware is: LT-Plus 1.9 

Spoofing Target 

DVD Key copied to target 

Key Sector copied from Source to Target 
Target is LT - ID strings not copied to Target 


Ma] 


Connect your spare 9504 PCB 


Select MTK Flash 32 Tab 


Press Slim UnLock Button 
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Firmware Tool 32 DVDKey 32 MTK Flash 32 Hitachi GDR3120 IRC Channel 
activate.iso 
VO Port USB Only [7] VIA ports Only 360 Tools 
0000 ~ [k=]  Indude non-IDE Ports C Beng Sammy | | Lite-On 
UnLock UnLock Erase 
Port Properties 
I/O Address: 0x0000 ZW Flash Chip Properti 
— — Vendor ID 
Channel: Primary Device ID 
Postion: Master 
Name: 
Device XECUTER X360USB PRO Si 
{ Ver 0.18 ) ze 
Type: 
Flashing Tasks 
Intro / Device ID Outro / ATA Reset 
Read Erase 


DVD Key: 


Found 0 Com Ports. 


Verified E 


Found 13 windows drives C: D: E: F: G: H: I: K: L: M: N: O: P: 
Found 2 CD/DVD drives D: 0: 


Drive is Slim Lite-On.. 


Key found in KeyDB at record (10 - New folder) 


EEEE 
Key has been test and verified, thanks C4eva ! 


The screen should now show the drive in vendor mode (Unlocked) 
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m 


activete.iso 


VO Port USB Only [¥] VIA ports Only 360 Tools 
00000 v (am Include non-IDE Ports Beng Sammy Lite-On 
UnLock | | UnLock | | Erase 

Port Properties 

VO Address: 0x0000 SP fan Op Popa 

Type: USS Vendor ID: OxEF 

Channel: Primary Device ID: 0x11 

Postion: Master Winbond/NEX(W25P20/NX25P20) 

Device. XECUTER X360USB PRO : 

( Ver 0.18) : 262144 bytes 
Serial flash with status 0x72 

Drive Properties 

Vendor: Drive in Vendor Mode! 

Name: 

F/W Rev: 

Reserved: 


DVD Key: Verified E 


Serial flash found with Status 0x72 


Sending Device ID request to port 0x0000 
Spi Status: 0x00 

Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: Winbond/NEX(W25P20/NX25P20) 
Flash Size: 262144 bytes 


Press the Write Button 


The log window will scroll through the operation as it erases, writes and then 


authorizes the process! 


Showing similar to below 
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4 amaj 


Getting Status from port 0x0000 
Invalid Status 0x50 

‘Sending Vendor Intro to port 0x0000 
‘Status 0x51 

Re-sending vendor Intro: 


‘serial flash found with Status 0x72 


‘Sending Device ID request to port 0x0000 
‘Spi Status: 0x00 

Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: wWinbond/NEX(W25P20/NX25P20) 
Flash Size: 262144 bytes 


This is what you should see 
appearing in the log as you 
write to the drive 


Key found in KeyDB at record (10 - New folder) 
Key is: A 
Key has been tested and verified, anks C4eva ! 
Now you must Lock the Spi if you intend to use this on Xbox live 


Then press Intro / Device ID 


This box will appear 


Page 222 of 272 


Things not going as expected? — Read the FAQ’s 


runorna M 


@ F you wish to resend the command you should click Yes. 


Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Press the Spi-Lock Status Button 


Currently displaying 0x00 


(x) = Warning 


This lock can be quite permanent... You should stop if: 

You do not have a Sputnik or Russian type hack for MXIC. 
-OR- 

Cannot do a Kamikaze hack on Winbond. 


ea Geas 


Heed this warning — once locked you will require hardware modification to unlock 
the PCB in the future! 


Click OK 
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You should see the Spi lock message in the log and the button will show Ox8C like 
this: 


Sending Device ID request to port 0x0000 a 
Spi Status: 0x00 

Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: Winbond/NEX (W25P20/NX25P20) 

Flash Size: 262144 bytes 


Sending Slim Spi Lock request 
Spi Status: 0x8C [9 


Now press Outro/ATA Reset button 


FimwareTool 32 | DVDKey32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel 


activate.iso 
VO Port USB Only [7] VIA ports Only 360 Tools 
00000 hi (m) Include non-IDE Ports som Lite-On 
Port Properties 
VO Address: 0x0000 ZW Flash Chip J 
Type: USB V D 
Channel: Primary Dea 
Postion: Master 
Device: XECUTER X360USB PRO ae 
( Ver 0.18) Size: 
Type: 
Drive Properties 
Vendor: No Drive Detected! Flashing Tasks 
Name: Intro / Device ID Outro / ATA Reset 
F/w Rev: 
Read Erase 
Sei | Wie | 
DVD Key: Verified f Phat @ © Slim | 


Reading Bank 22 <i. sccecccsccacs 
Beading BE 32 o22cccccdacecnnss 
Write verified OK ! 


IMPORTANT! 


After sending Outro / ATA Reset, 
Sending Spi Lock to Port 0x0000 If this IS all you see! 
Success ! YOU MUST 


Spi Status: 0x8C 
Sending Vendor Outro to port 0x0000 


press Outro / ATA Reset AGAIN! 


Now Power off the drive, disconnect and refit to your xbox and test! 
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YOU ARE FINISHED — CLICK HERE TO RETURN TO START 
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Unlocking a Slim Liteon PCB 


There are 2 differing vendor producers of LiteOn PCB Chips: 


Open your Drive and look at the Main IC on the PCB (click on the chip you have) 


MEDIATEK 
MT1335WE 
1044-CMSL 
BTP3Y162 
03xXC60144380003 


03 = MXIC 


MEDIATEK 
MT1335WE 
1044-CMSL 
BTP3Y162 
05XC60144380003 


05 = WINBOND 
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MXIC UNLOCKING 


There are several methods to unlock these PCB’s, we will only mention the 3 main 
ones here. They all work on exactly the same principle any way. And their use is 
almost identical. 


1. The Sputnik360 MX Edition PCB from Team-Xecuter 


ZPUTNIKZEQR 


MX(EDITION 


A simple to fit PCB with switch and selectable resistors. Makes this a very easy 
to use unlock solution. 


1 simple trace cut and 3 solder points will permanantly attach to the PCB in 
your drive. This will make future updating of firmware simple as can be. 
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2. The Sputnik MX Probe 


Make the same trace cut shown below and use it to probe same via point 


3. The Basic Russian Hack 


| Cut along Red Line 


Probe the orange circle. 


AP 


(Thanks to whoever posted this picture on the net! - ) 
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This involves 1 trace cut and soldering a 10 Q(approx) Resistor to GND — 
then momentarily touching the VIA that you cut from the trace(at the 
appropriate time) 


Either method — proceed as follows 


CLICK HERE TO CONTINUE 
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WINBOND UNLOCKING 
Kamikaze Unlock 


WARNING: THIS LOOKS EASY - BUT IT CAN BE MESSED UP VERY VERY 
EASILY. 


Using this method, it is very easy to cut wrong wire, or more than 
1 wire- destroying the chip and rendering it useless! - 


DO NOT START COMPLAINING IF YOU MESS THIS UP - YOU HAVE BEEN 
WARNED 


This involves cutting into the IC with a Dremel whilst providing 3.3v with a 100 Q 
capacitor in series at the Dremel tip and sending SPI unlock command at the same 
time! The picture below show the complexity and point you are aiming to cut! 


ats 


yä 


BBA 


if 
f 
TAANIT 


MIA 


{ 


ae yy, 
Pri Ws 


F-H 


H 


ys > < A - jj . S A. 
ê 4 N H J Bye $ 
= OS AA A 4) \\ S 
[ERB 2 wh $ 


À, 
# 


Please research as much on this method as possible before even considering using 
it! (It wasn’t named Kamikaze Unlock Method for nothing) 
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You must first be as accurate as possible and mark the top of the chip with the 
correct point at which you are aiming to find the correct internal wire. The 


picture below shows the location of the point! 


DO NOT RELY ON THE WHITE TEXT ON THE CHIP - IT VARIES IN POSITION FROM 
CHIP TO CHIP! 


$ 5 pins in from right ATE: 


MEDIATEK 
MIT i SJOWEe 
1016-B8LSL 
8 pins down CUGO4247 8 pins down 
from top xB307838000 from top 


ii EELE 
4 Spins in from right idli 


(Uninstalled chip shown for clarity) 


Measure 5 pins in from the right (on the top and bottom row of pins) mark the 
line with a very thin bladed scalpel and steel rule. 


Then measure 8 pins down from the top (on the left and right side pins) mark the 
line. 
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Where these lines cross, is the point you are aiming to cut. 
There are several methods to achieve the cut (Dremel, soldering iron, knife) 


The Dremel appears to be the most accurate — providing you have a steady hand 
and good eye. (again, DO NOT ATTEMPT UNLESS YOU ARE SURE YOU 
UNDERSTAND THE RISKS!) 


Dremel Method 


The method is to slowly perform the grinding whilst contacting the cutting tip 
with a 3.3v supply with a 100 Q resistor in the line. 


keep in contact at all times 
during cutting 
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3.3v can be obtained from the PCB itself or from your 3.3V cable in drive power 


cable (the cable the switch is on, on the probe 3 cable) 


3.3V source on PCB 


The important thing is accuracy and very light pressure! Cutting slowly to ensure 
you don’t overcut and destroy other wires in the chip. Listen for the BEEP and 
keep a check on the screen status! (Dremel tip used here is 0.8mm cutting head). 


TEAM JUNGLE and Jungleflasher author take no responsibility if you screw your 
drive using this method! — It is awkward and fiddly. If you don’t feel confident 
then pay someone to do the job for you! 


CLICK HERE TO CONTINUE 
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Locked Slim LiteOn Drives 


First — You should have prepared your Winbond or MXIC unlock method in 


advance. 
Then open Jungleflasher, select MTK Flash 32 Tab 


Select the correct I/O port 


Power on your drive, click I/O Port refresh button and ensure drive properties 


show up 


FimwareTool 32_| DVDKey 32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel 


activate.iso 
I/O Port USB Only V] VIA ports Only 360 Tools 
me) e sos, (Sex| [2] [uta 
Port Properties 
VO Address: Ox0000 ee Flash Chip P 3 
pr zi Vendor ID: 
Ceres Husy Device ID: 
Postion: Master van 
Device: XECUTER X360USB PRO ae 
({ Ver 0.18 ) ze: 
Type: 
Drive Properties 
Vendor: PLDS Flashing Tasks 
Name: DG-16D4S Intro /Device ID | | Outro / ATA Reset | 


Reserved: ADA 
DVD Key: Verified F Phat @ © Slim 


Found 0 Com Ports. 

Found 14 windows drives C: D: E: F: G: H: I: J: K: L: M: N: O: P: 
Found 2 CD/DVD drives D: O: 

Drive is Slim Lite-On.. 

Key found in KeyDB at record (13 - Black SLIM 0225) 


Key is: CM 
Key has been tested and verified, thanks C4eva ! 


Now Press Intro / Device ID button 
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m 


Once in vendor mode, Press the Spi Status Button (currently showing 0x8C) 


FimwareTool 32 | DVDKey32 | MTKFlash 32 | HitachiGDR3120 | IRC Channel 


activate.iso 
VO Port USB Only [¥] VIA ports Only [_ Soh 
00000 ~ (ks) Include non-IDE Ports [ Beng Sammy | | Lite-On 
UnLock UnLock Erase 

Port Properties 

VO Address: 0x0000 CP Flash Chip Properties 

Type: USB Vendor ID: OxEF 

Channel: Primary Device ID: 0x11 

Postion: Master Name:  Winbond/NEX(W25P20/NX25P20) 

Device: XECUTER X360USB PRO 

(Ver 0.18) Size: 262144 bytes 
Type Serial flash with status 0x72 

Drive Properties 

Vendor: Drive in Vendor Mode! Flashing Tasks 

Name: Intro / Device ID Outro / ATA Reset 


DVD Key: Verified f Phat©® © Slim 


Sending Device ID request to port 0x0000 
Spi Status: 0x00 

Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: Winbond/NEX (W25P20/NX2Z5P20) 
Flash Size: 262144 bytes 


Sending Slim Spi Lock request 
Spi Status: 0x8C 


Because your drive has a locked Spi — this message will show up 


e Spi Status Register is S/W protected 


P If you wish to resend clear Spi Status Register 


Press Escape to cancel. 


Gs) Le) 
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Press Yes 


Jungleflasher will now start to continuously send the unlock command to the 
drive. This will be shown in the log, represented by appearing dots 


Postion: Master 
Name: 
Device: XECUTER X360USB PRO ceo 
( Ver 0.18) Size: 
Type: Spi Status register 0x8C 
Drive Properties 
Vendor: PLDS Flashing Tasks 
Name: DG-16D4S tro / Device ID Outro / ATA Reset 
F/W Rev: 0225 =e = 
Reserved: ADAD — 
DVD Key: Verified E Phat © Slim 
Key found in KeyDB at record (13 - Black SLIM 0225) - 


Key is: C 
Key has been tested and verified, thanks C4eva ! 
Sending Vendor Intro to port 0x0000 


Serial flash found with Status 0x72 


LARI 


At this point you commence with which ever unlock procedure you are following 


NOTE: FOR EASE ENSURE YOUR SPEAKERS ARE ON AND VOLUME IS UP AS AN AUDIBLE BEEP 
WILL OCCUR WHEN YOU ACHIEVE AN UNLOCKED STATUS OF 0x00 


Dependent on your drive Vendor Manufacturer and the method you 
are attempting to unlock the drive — choose the appropriate item 
from the table below. 


UNLOCK PROCEDURE OF CHOICE 
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MXIC 


WINBOND 


a. Put switch to unlock on 
SPUTNIK360 MX Switch 


b. Probe the VIA (Sputnik360 MX 
Probe) 


c. Probe The VIA (Russian hack 
wire) 


Start up your Dremel, and begin 
grinding (ensuring you have the 3.3v 
power supply with resistor in contact 

with the Dremel tip) 


“SLOWLY DOES IT!” 


Good Luck! 


PREVIOUSLY UNLOCKED DRIVES 


Carry out as above 


Simply touch same 3.3v +100 Q wire in hole — 
Or drop a little rubbing alcohol(or similar) into 
hole 


At the point that Jungleflasher is able to successfully unlock the drive — a “DUAL- 
TONE BEEP” will be heard through your speakers and you should see this 


Serial flash found with Status 0x72 


Sending Device ID request to port 0x0000 
pi Status: 0x00 


Manufacturer ID: OxEF 


Device ID: 0x11 


Flash Name: Winbond/NEX (W25P20/NX25P20) 


Flash Size: 262144 bytes 


(once 0x00 has been achieved — stop probing / switch sputnik back to normal 
/stop dremeling) 


Now as always, read the Original Firmware from the drive for safe keeping, by 
pressing the Read button 
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Flashing Tasks 


| Intro / Device ID | | Outro/ATAReset | 
[Eme ] (wae 
Pht© © Slim 


as part of the read you will be faced with this 


i 
MTK Vendor Intro failed 


> 1 If you wish to resend the command you should click Yes. 
‘Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


Click YES then Cycle the power to the drive OFF then ON 


You will then be asked to save your Firmware — DO SO! 


This is your Original Firmware (stock) keep it safe 
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oe F 
X | s |í Search 130test =” P2 
pue O O O O O UUU U = = = 


(GJON [JE > Computer + DATA (F) » BACKUPS- myxbox > 130test 

Organize œ New folder gz vy @ 

g | Date ied ai | Type | Size | 
02/08/2011 21:46 Open 256 KB | 
26/01/2011 18:59 Open 


B Documents ~ Name 

G) Download 

al PERDS L] Lite-OFW.bin 

d Music OFW.bi 
SAM- DIN 

E] Pictures aa 

E Videos 


ĝ Homegroup 


jE Computer 
& Local Disk (C:) 
© OLD win7 (E:) 
ca DATA (F:) 
© Local Disk (G:) 
c@ New Volume (H:) 


TAY 


Filename: Lite-OFW.bin 
Save as type: l Firmware Images (*.bin) 


~ Hide Folders 


Click Save 
Your firmware will automatically be loaded into source in the Firmware Tab 
You will then be asked if you wish to autoload iXtreme. 


Click YES 


$à Lite-On firmware loaded to Source buffer! 
” Do you wish to auto-load Lite-On iXtreme ? 


The latest firmware will be autoloaded from the firmware folder (where you 
should have placed it earlier) 


And your drive details will be spoofed into the firmware in target buffer, ready to 
be written to the drive. 
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FimwareTool 32 | DVDKey 32 | MTK Fash 32 | HitachiGDR3120_|_IRC Channel 
= ai Tomasas 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ na Key 
Lite-On DG-16D4S 1071 Stock Se 
OSIG:[PLDS DG-16D4S Sed Source 
7 anced . User Guide 
= aa = Ensure the keys in source and target 
match - before proceeding! 
Target | inquiry | identify | Dri p g open Target 
F:\JFBeta\Fimware\LTPlus- 
Manual 
Vendor Model Rev Firmware Type DVD Key @ nla Spoofing 
Lite-On DG-16D4S 1071 LT-Plus 1.92 Sea 
OSIG:[PLDS DG-16D4S 1071) Save to File 


DVD Key copied to target 
Key Sector copied from Source to Target 
Target is LT - ID strings not copied to Target 


> 


Drive is Lite-On.. 


Key found in KeyDB at record (20 - N/A) 
Key is: 
Key has been tested and verified, thanks C4eva ! | jj 


To write the prepared firmware to the drive you must place the drive into vendor 
mode once again. 


Simply select MTK Flash 32 tab 


Firmware Tool 32 MTK Flash 32 | Hitachi GDR3120 | IRC Channel 


Now press Intro / Device ID button 


You may or may not be asked to resend and power cycle 
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rel 
MTK Vendor Intro failed es 


Cà If you wish to resend the command you should click Yes. 
ED Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


(ae | 


If so — click YES then Cycle the power to drive! 


The drive should appear in vendor mode once again 


[_FimwareTool 32_| DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


1/0 Port 
00000 


activate.iso 


USB Only (V| VIA ports Only 


VO Address: 0x0000 


Type: 


Device: XECUTER X360USB PRO 


360 Tools 
X (a) Include non-IDE Ports Beng Sammy Lite-On Slim 
EF i UnLock UnLock Erase UnLock 
A Flash Chip Properties 


USB 
Vendor ID: OxEF 


Device ID: 0x11 
Winbond/NEX(W25P20/NX25P20) 

( Ver 0.18) ize: 262144 bytes 

Serial flash with status 0x72 


Drive Properties 
Vendor: Drive in Vendor Mode! 


DVD Key: Verified 9 


Sending Vendor Intro to port 0x0000 a 


Serial flash found with Status 0x72 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxEF 
Device ID: 0x11 


Flash Name: 
Flash Size: 


Winbond/NEX (W25P20/NX2SP20) 
262144 bytes 


4 


Now the drive is in Vendor Mode, select the Write Button 
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Flashing Tasks 


Intro / Device ID Outro / ATA Reset 
(miea) (feo 
Phat © © Slim 


Writing will commence and its progress shown in the log 


Getting Status from port 0x0000 
SPi flash found with Status 0x72 


Sending Chip Erase to Port 0x0000 
Erasing: 

writing target buffer to flash 
writing Bank O: ...552s...cs5..5- 
Writing Ba 22 ponera aaea 
Witing hank 2: s2ccccccnceskx se 
Writing Bank J: 2aisicccncsnssan 
Flash verification Test ! 
Reading Bark Ož wcccccccccccceeu 
Reading Bank 1: ....... eee eee eee 
Reading Bank 2: .........eeeeeee 
Reading Bank 32 2scccesececcacse 
Dumped in 4912ms 


write verified OK ! 
Restoring sector Ox3E000. 
Sending Sector Erase to Port 0x0000 


Erasing: Ox3E000 
writing: Ox3E000 


Restore verified OK ! 
Drive is Lite-on.. 


Key found in KeyDB at record (20 - N/A) 
Key is: 
Key has been tested and verified, thanks C4eva ! 


Now to RE-LOCK the drive! 


To re-lock the drive it must be in vendor mode 


So once again — Press Intro /Device ID 
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You will be asked to resend and power cycle 


MTK Vendor Intro failed 


If you wish to resend the command you should click Yes. 
P» Power off the drive and then back on (within 1 second). 


Press Escape to cancel. 


click YES then Cycle the power to drive! 
The drive should appear in vendor mode once again 


Simply press the Spi Status Button (currently 0x00) 


Write 
© Siim 


Warning 


This lock can be quite permanent... You should stop if: 

You do not have a Sputnik or Russian type hack for MXIC. 
-OR- 

Cannot do a Kamikaze hack on Winbond. 


Click OK 


You should see the following in the log 
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Sending Device ID request to port 0x0000 a | 
Spi Status: 0x00 

Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: Winbond/NEX (W25P20/NX25P20) 
Flash Size: 262144 bytes 


Sending Slim Spi Lock request 
Spi Status: 0x8C 


m 


And the Spi Status Button should now show 0x8C 


Flashing Tasks 


Now press Outro/ATA Reset button 


veve. MLV I L VVV i 


(Ver 0.18) Size: 
Type: 
Drive Properties 

Vendor: No Drive Detected! Flashing Tasks 
Name: Intro / Device ID L Outro / ATA Reset 
F/W Rev: 
ee | wie | 
DVDKey: Verified f Phat® © Slim | 


Banding Hank 22 2c cccsseseccsw cs 
Banting Bark Jz osc és ceeeeaes 
Write verified OK ! 


IMPORTANT! 


After sending Outro / ATA Reset, 
Sending Spi Lock to Port 0x0000 If this is all you see! 
Success ! YOU MUST 


Spi Status: 0x8C 
Sending Vendor Outro to port 0x0000 


press Outro / ATA Reset AGAIN! 
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If you see this Key Verification message then — Outro has been successful 


Sending Slim Spi Lock request 

Spi Status: 0x8C 

Sending Vendor Outro to port 0x0000 
Drive is Lite-On.. 


Now Power off the drive, disconnect and refit to your xbox and test! 


YOU ARE FINISHED — CLICK HERE TO RETURN TO START 
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LiteOn Slim FW Ver. 09504 / 0272 (dash 13146) 


There are 2 methods available to obtain the drive details you require from this 
drive. You can either 


A. Dump the original Firmware from the drive (always recommended) 


B. Use SlimKey 


Method A — Dump the original Firmware 
Dumping the Original Firmware is very straight forward. 


Select MTK Flash 32 tab 


FimmwareTool 32 | DVDKey 32 | MTK Flash 32 | HitachiGDR3120 | IRC Channel | 
| 


First ensure it inquires on the I/O port. 


Pot Properties 
VO Address: 0x0000 AA 
Type USB 
Channel Primary 
Postion Master 
Device XECUTER XG60USB PRO 
( Ver 0.17) 


DG-16D4S 


Reserved ADAD 
DVD Key Not Found 
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Now select Slim Unlock 


Pe JungleFlasher 0.1.81 Beta < x N 


FimwareTool 32 | DVDKey 32 Hitachi GDR3120_|_ IRC Channel 3 
activate.iso Q 
SARK 


[7] VIA ports Only | 360 Tools WARTA TNO ES 


EE] 


Send Unique Password to unlock Spi! 


Flash Chip Properties 
Vendor ID: 
Device ID: 


XECUTER X360USB PRO 
( Ver 0.18) 


Drive Properties 
Jungleflasher will unlock the drive and place it into Vendor Mode 


4 
 JungleFlasher 0.1.81 Beta | a g 


FimwareTool 32_| DVDKey 32 | MTK Fash 32 | Hitachi GDR3120 | IRC Channel | 


activate.iso x 
VO Port USB Only [V] VIA ports Only | 360 Tools YANRANTI bees TALES 


00000 ~ (k) include non-IDE Ports [7] | Danes | | — | Lite-On | | Slim | 

Pot Popes hlod. (inlade) | Eas. | Lloc Connect any 

| OC cee SATA device 
Vendor ID: OxEF to any 


Device ID: 0x11 PC or laptop 


: Winbond/NEX(W25P20/NX25P20) 
XECUTER X360USB PRO via USB 


( Ver 0.18 ) ize: 262144 bytes 
Serial flash with status 0x72 


Drive 


Properties 
Vendor: Drive in Vendor Mode! 


Fiw Rev: 
Reserved: 
DVD Key: Not Found 


Sending Vendor Intro to port 0x0000 
Serial flash found with Status 0x72 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxEF 


Device ID: 0x11 er 
Flash Name: Winbond/NEX (W25P20/NX25P20) _ | @PX360USBa 
Flash Size: 262144 bytes 
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Now the drive is in Vendor Mode, simply click on the Read Button 


i / Dee 
[Read] [ Eese ] (_wite | 


Phat € @ Slim 


This will produce some text in the log as it reads the original Firmware from the 
drive 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: winbond/NEX(W25P20/NX25P20) 
Flash Size: 262144 bytes 


Updating flash for on-line dump. 

Sending Sector Erase to Port 0x0000 

Erasing: Ox3E000 

writing: 0x3E000 

Reading Bank O: ..........2220ee 

Reading Bank 1: ..... eee eee eee 

Reading Bank 2: ...... eee eee eee 

Reading Bank J ccccsccctwuss wan 

Dumped in 4828ms 

Restoring sector 0x3E000. 

Sending Sector Erase to Port 0x0000 

Erasing: Ox3E000 

writing: 0x3E000 

Authorised ! 

Restore 0x3E000 verified ! 

Lite-On Dump file saved to Lite-OFW.bin 

er ba Firmware from buffer 

Drive key @ n/a #########REMOVEDS#HH Hee HHH SHH FA 
Firmware Osig: [PLDS DG-16D45 504] 


Firmware is: stock 
Key added to database 


You will also be prompted to save the file you have just dumped. It is 
recommended you do so! 


Note: This is your original firmware — please keep it safe 
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a r 
eg =| « Desktop » x360usb » 9504 ~ | +4] | Search aai 


Views f New Folder 


Date modified Type 


vorite Links 
4 Dummy 


Desktop 
Å Lite-OFW 


Recent Places 
Computer 
Documents 

| Pictures 
Music 

j Recently Changed 
Searches 
Public 


Folders a 


Filename: (Sis) 
Save as type: | Firmware Images (*.bin} kd 


\* Hide Folders 


Now Jungleflasher will change to the Firmware Tool 32 Tab and automatically 
load your OFW as the source. Then ask if you wish to Auto-Load Latest Firmware 


f 
Loading Source 


-Ii an ` 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


Click yes to Auto-Load the Firmware and Auto-Spoof your data from your drive 
into the ixtreme. 
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, 
$ JungleFlasher 0.1.81 Beta 


FimwareTool 32 | DVDKey 32 | MTK Aash 32 | HitachiGDR3120 | IRC Channel | 


VARRTA AIONE ETE 


Source Open KeyDb 
F:\BACKUPS - my xbox\My New Slim\Lite-OFW bin (a 
Save Drive 
Vendor Model Rev Firmware Type DVD Key@ nia Key 
Lite-On DG-16D4S 9504 Stock 
Open Source 
Firmware 


OSIG:[PLDS DG-16D4S 9504] 


User Guide 


Open Target 
Firmware 


Vendor Model Rev Firmware Type DVD Key@ nla Spoofing 


Lien DGA6DKS 950  LT-Pus e 


OSIG:[PLDS DG-16D4S 9504] 


Firmware Osig: [PLDS DG-16D4S 
Firmware is: LI-Plus 

Spoofing Target 

DVD Key copied to target 

Key Sector copied from Source to Target 


Inquiry string copied to Target 


Identify string copied to Target 
Serial data copied from Source to Target 


Now re-select MT Flash 32 Tab 


FimwareTool 32 | DVDKey 32 | MTKAash 32 | HitachiGDR3120 | IRC Channel 


You will notice in the log that the key has now been Verified against the drive 


Drive is Slim Lite-on.. 


Key found in KeyDB at record (10 - My New Slim) 
Key is: #########REMOVED##HH eee eeeeeesee 
Key has been tested and verified, thanks C4eva ! 


To be able to write the target firmware to the drive you must unlock the drive 
once more (it was taken out of Vendor mode to Verify the Key) 
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Write Firmware to the Slim 9504/0272 


Select Slim Unlock 


 JungleFlasher 0.1.81 Beta 


Hitachi GDR3120_|_ IRC Channel 


FimwareTool 32. | DVDKey 32 


activate.iso 
[7] VIA ports Only HAARATI NTI eS CTL 


Include non-IDE Ports S Lite-On Slim 


VO Address: 0x0000 CP Bee epee | Send Unique Password to unlock Spi! 
Type: USB nan sown 


Vendor ID: 
Device ID: 


Primary 


Master 


XECUTER X360USB PRO 
(Ver 0.18) 


Name: 


I Drive Properties ye 


Jungleflasher will unlock the drive and place it into Vendor Mode 


g 
@ JungleFlasher 0.1.81 Beta 


FimwareTool 32 | DVDKey 32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


activate.iso 


1/0 Port USB Only [¥] VIA ports Only 360 Tools waaraan 


0x0000 v (a) Include non-IDE Ports 


Vendor ID: OxEF 
Poo Mee Device ID: 0x11 
Device: XECUTER X360USB PRO sep pe Aa 
( Ver 0.18) ize: 262144 bytes 
Dive Popas Serial flash with status 0x72 
Vendor: Drive in Vendor Mode! 
Name: 
FAW Rev: 
Reserved: 
DVD Key: Verified E 


Sending Vendor Intro to port 0x0000 


Price 


£39.95 


Serial flash found with Status 0x72 


Sending Device ID request to port 0x0000 
Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: Winbond/NEX (W25P20/NX25P20) 
Flash Size: 262144 bytes 


(Notice that the drive shows Verified this time) 
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Now the drive is in Vendor Mode, select the Write Button 


E _ } 


Serial flash found with status Ox72 


sending Device ID request to port Ox0000 
Manufacturer ID: OxEF 

Device ID: 0x11 

Flash Name: winbond/NEX(Cw25P20/NX25P20) 
Flash size: 262144 bytes 


Getting Status from port Ox0000 
SPi flash found with status 0x72 


sending Chip Erase to Port Ox0000 
Erasing: 

writing target buffer to flash 
Mtcim Bark OS .cneceooccctce ec 
Writing Bare 2s ccsccc ccc ccc 
Mtl Bark 25 ois eo cece ec eus 
Writing Bank 3: ........----.-.----. 


Flash verification Test ! 
Reading Bank Of 2266526 nten 
Reading Bank 1: ..............-.-. 
Reading Bank 22 2265266 cee eee 
Reading Bank 35 cele eee cee 
Dumped in 4885ms 


write verified OK ! 
Restoring sector Ox3E000. 


sending sector Erase to Port Ox0000 
Erasing: Ox3E000 
writing: Ox3E000 


Authorised ! 
Restore verified OK ! 
Drive is Slim Lite-on.. 


Key found in KeyDB at record (10 - My New slim) 
Key is: #######22REMOVEDS#SF SSF FF 8288444 
Key has been tested and verified, thanks C4eva ! 


Writing will commence and its progress shown in the log 


YOU ARE FINISHED — CLICK HERE TO RETURN TO START 
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Method B — Using SlimKey 


First select the correct I/O port and ensure drive shows up in drive properties 


= gi _ S 


FimwareTool32 | DVDKey32 | MTK Fash 32 | HitachiGDR3120 | IRC Channel | k 
TOLE 


F 
 JungleFlasher 0.1.81 Beta 


Q 


o 
I/O Port USB Only [7] VIA ports Only C] Additional functions WANATOA S 
0x0000 v (a) Include non-IDE Ports [7] 


Port Properties 
VO Address: 0x0000 


use BUY NOW 


Primary FROM 
Master 


XECUTER X360USB PRO 
{Ver 0.18) 


X360USB PRO detected, Version 0.18 


Found 12 I/O Ports. 

Found 0 Com Ports. 

Found 14 windows drives C: D: E: F: G: H: I: J: K: L: M: N: O: P: 
Found 2 CD/DVD drives D: 0: 


PortIO unloaded. 
Drive is Slim Lite-On.. 


Then select SlimKey Button 


You will be faced with Jungleflasher asking if you want to send Unlock to slim — 
click YES 
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FirnwareTool 32 | DVDKey 32 


MTK Flash 32 | HitachiGDR3120 | IRC Channel 


VO Port USB Only [©] VIA ports Only [E] Com Port Additional functions [7] 
00000 ~ [...] include non-IDE Ports [7] coms -| ol Dummy bin Only [E] 
Port Properties Com Port Properties 
VO Address: 0x0000 ee Port: COM8 
Type: USB Type: Xecuter CK3CP (CK3) 
Channel: Primary Name: XECUTER CK3CP USB Controller 
Postion Master 
Device: XECUTER X360USB PF 
( Ver 0.17) 
Drive Properties 
Vendor: PLDS 
Name: DG-16D4S 
F/W Rev: 9504 
Reserved: ADAO 
— 
DVD Key Not Found Dummy from KeyDB Dummy from iXtreme 
0000: 05 80 00 32 5B 00 00 00 - 50 4C 44 53 20 20 20 20 ...2[...PLDS 
0010: 44 47 2D 31 36 44 34 53 - 20 20 20 20 20 20 20 20 DG-16D4S 
0020: 39 35 30 34 00 00 00 00 - 00 00 00 00 00 00 00 00 9504............ 
0030- 00 00 00 00 41 30 41 30 — 00 00 00 00 00 00 00 00 ....AOAO........ 
6040: 00 00 00 00 00 00 80 00 .— 00 00 80.00 00 00 60 00 casana 
0050: 00 00 00 00 00 00 00 00 - 00 00 00 00 GO 00 BGO OO .......- eee 
0060: 44 37 31 31 43 47 30 31 - 37 39 30 32 30 30 33 S2 D711CG017902003R 
0070: 44 00 00 00 Biss 


Once Jungleflasher has carried out its Unlock Procedure — it will Automatically 
Grab the Key and all other required information from the drive and generate a 


Dummy.bin. 


You will be prompted to save the generated Dummy.bin 


Things not going as expected? — Read the FAQ’s 
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Organize v New folder 


B Documents = Name Date modified Type Size 
Downloads 
a Music 
Pictures 
B& Videos 


01/04/2011 19:49 


aĝ Homegroup 


j Computer 
& Local Disk (C:) 
& OLD win7 (E:) | 
ca DATA (F:) 
& Local Disk (G:) 
ca New Volume (H: 


+ 


(ate AY 


Filename: Dummy.bin = 


Save ss ype | 
| 
+ Heroes C 


Please do so — having a saved copy of your Dummy.bin will enable very easy updating at any 
point in the future. 


Jungleflasher will then proceed to Load your newly generated Dummy.bin as the Source File in 
FirmwareTool 32 Tab and ask if you wish to Auto-Load the latest iXtreme Firmware. 


Lite-On firmware loaded to Source buffer! 
Do you wish to auto-load Lite-On iXtreme ? 


EE l 


Select Yes 


You will be faced with this 
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FimwareTool 32 | DVDKey32 | MTK Fash 32 | HitachiGDR3120 


F:\BACKUPS - my xbox\\My New Slim\Lite-OFW0272 bin 


Vendor Model Rev Firmware Type DVD Key e ; na 7 
Lite-On DG-16D4S 0272 Stock 


Vendor Model Rev Firmware Type DVD Key @ na PeR 
Lite-On DG-16D4S 0272 LT-Plus 1.9 TAA 
OSIG:[PLDS DG-16D4S 0272] Save to File 


> 


Genuine LT plus v1.9 

Drive key @ n/a FEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF 
Firmware Osig: [PLDS DG-16D4S 0272] 
Firmware is: LT-Plus 1.9 

Spoofing Target 

DVD Key copied to target 

Key Sector copied from Source to Target 

Target is LT - ID strings not copied to Target 


Now return to the MTK Flash 32 Tab 


FimwareTool 32 | DVDKey 32 | MTK Flash 32 | Hitachi GDR3120 


You will notice in the log that the key has now been Verified against the drive 


Drive is Slim Lite-on.. 


Key found in KeyDB at record (10 - My New Slim) 
Key is: #########REMOVED###e eee EREHE 
Key has been tested and verified, thanks C4eva ! 


To be able to write the target firmware to the drive you must unlock the drive 
once more (it was taken out of Vendor mode to Verify the Key) 
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CLICK HERE TO CONTINUE 
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Sammy Return to Stock 


When asked to auto load firmware select NO 


Select Open Target Firmware 


FimwareTool32 | DVDKey 32_| MTK Fash 32 | HitachiGDR3120 | IRC Channel | 


"Source | inguiy | Ment | Dive Seral 


F:\Sam_CFW bin 
Save Drive 
Vendor Model Rev Firmware Type DVD Key @ 40EC Key 
Samsung TS-H943A MS28 iXTREME1.6-12x-FIN/ 92F3CBFSD84EA8SCADEDAASDSCDAIEF2 
-TS-H943A 
OSIG:[TSSTcorpDVD-ROM TS-H943Ams28] Spoofed As: [TSSTcorpDVD-ROM TS-H9%43Ams25] j 
v| Advanced View Spoof Source to Target User Guide 
z z P Ti 
Target | Inquiry | Identify | Drive Serial Open Target 
Manual 
Vendor Model Rev Firmware Type DVD Key @ Spoofing 
OSIG: Spoofed As: Save to File 


Select the stock firmware for your drive 
MS25 or MS28 


A MS25 is shown in the example 
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FimwareTool32 | DVDKey 32_| MTKFlash 32 | HitachiGDR3120 | IRC Channel | 


F:\Sam_CFW bin 


Vendor Model Rev Firmware Type DVD Key @ 40EC 
Samsung TS-H943A MS28 iXTREME1.6-12x-FINé S2F3CBFSD84EA8SCADEDAASDSCDAIEF2 
‘S-H9434 


F 
OSIG:[TSSTcorpDVD-ROM TS-H943Ams28] 


das Spod Source to Tage (Donate. =at 
Target | Inquiry. | Identify | Drive Serial 


F:\JFBeta \Fimware\Original\TS-H943 - MS25 bin 


Ma 


: 
i 


Vendor Model Rev Firmware Type DVD Key@ 401A 
Samsung TS-H9434 MS25 Stock B84E44767F6E5CBBOFC43D 1B060B4858 


LEI 


Press the Spoof Source to Target button 


FimwareTool 32 | DVDKey 32 | MTKAlash 32 | Hitachi GDR3120 | IRC Channel 


Vendor Model Rev Firmware Type DVD. Key @ a= 


Samsung TS-H943A MS28 iXTREME1.6-12x-FIN¢ S2F3CBFSD84EA8SCADEDAASDSCDAIEF2 
-TS-H9434 


OSIG:[TSSTcorpDVD-ROM TS-H943Ams28] Spoofed As: [TSSTcorpDVD-ROM TS-H943Ams25] 


ae 


Advanced View Sapa Geka his Be User Guide 


F:\JF Beta \Firmware \Original\ TS-H943 - MS25.bin 


; 
i 


avis i= 


S2F3CBF9D84EASSCADEDAASDSCDAIEF2 


OSIG:[TSSTcorpDVD-ROM TS-H943Ams25] Save to File 


EI 


Vendor Model Rev Firmware Type 
Samsung TS-H943A MS25 Stock 


Note the keys Now Match 


CLICK HERE TO CONTINUE 
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Common problems and Frequently Asked Questions 


JungleFlasher tells me “Cant install portio32/64.sys driver” 


If you are running any OS other than XP x86, then you must run the 
program as Administrator, see here for explanation how! 


JungleFlasher tells me “No Com ports found during enumeration” 


The LiteOn DG-16D2S 74850c Drive requires the utilization of an RS232 
Serial Adapter to obtain the DVD Drives key (Unless you are using a Probe 
3/PMT). Unless you are doing one of these drives, simply ignore it and 
proceed. 


If you no longer use COM ports (With PMT there is no need) then you can 
stop Jungleflasher from Enumerating COM ports by setting DoCom (in 
registry — see advanced user functions) to the value 0 


BY Registry Editor — + = = - -o ~ 
File Edit View Favorites Help 
a jM Computer Name Type Data 
Ji HKEY_CLASSES_ROOT ab) (Default) REG_SZ (value not set) 
4 d HKEY_CURRENT_USER ab) Adwiew REG_SZ 0 
-A peapa ab) COMPort REG_SZ r 
" Crate ab) Delay32 REG_SZ 15 
B Control Panel 
B NAN ab] DoDevID REG_SZ 0 
B EUDC ab) DoDrives REG_SZ 1 
TÈ Identities ab) DolO REG_SZ 1 
J} JF KeyDB ab) DoUSBOnly REG_SZ 0 
P JungleFlasher ab) HitAPi REG_SZ 1 
dJi Keyboard Layout ab) HitRev REG_SZ 47 
iB Network | ab) HitTran REG SZ 1 


When using X360USB Pro — the drive reboots when trying to dump the drive or 
JungleFlasher seems to Lag OR | get erroneous issues 


Try changing the USB cable you are connecting the device with / failing that 
try another USB Port. 


JungleFlasher warns me of “No VIA Ports Found” 


Due to quirky issues with some VIA Motherboards with VIA PCI SATA Cards, 


causing JungleFlasher to fail to load, we’ve forced via ports only as default. 
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This, for those without a VIA PCI SATA card, or VIA motherboard will get 
this warning. 


If you do not have a VIA PCI card or a VIA Motherboard, proceed to the 
DVDKey32 Tab, and ensure Non-IDE Ports is checked. You will no longer 
get the warning when running JungleFlasher. 


JungleFlasher cannot see my drive 


There are multiple causes to this, so first of all ensure VIA Ports Only is 
unchecked and Non-IDE is checked under the DVDKey32 Tab. 


If using RAID, it will cause issues. Set it to Native IDE / Disable AHCI (Intel) / 
Raid in your computers BIOS. 


Use a Primary SATA port where possible. 
If using a VIA card ensure you use the correct port 


If problems persist, please join us in the support channel HERE 


JungleFlasher doesn’t see my DVD Drive (cont) 


Quite a few users believe JungleFlasher will report their Xbox 360 DVD 
Drive being Present in the Running Log: 


Found 4 I/0 Ports. 
Found 1 Com Ports. 
Found 8 windows drives C: D: E: F: G: I: J: 
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-m Second HDD (C:} —— Local Disk (D:} 


em Wil (E:) , Ql DVD-RW Drive (F:) 
Qe 
SI CD Drive (G:) <n Local Disk (1:3 


xp Local Disk (3:) Sen External (K:) 


JungleFlasher will only show drives that have been assigned a drive letter in 
windows. 


The only 360 DVD Drive that has this during the process is the Hitachi 
Drives (Once in mode-b) and using WinAPI. Please, don’t be surprised if 
JungleFlasher doesn’t enumerate your DVD Drive. 


| keep getting **Warning Serial Data is Bad** Errors when trying to DVDKey my 
LiteOn 


Are you sure it doesn’t have LT Firmware on it? LT Firmware does NOT 
allow DVDKey key extraction! 


Using Probe 2? — ensure “Standby” is disabled. 
Is it definitely a 74850c version? The 83850c V1 uses LO83Info instead. 
If this is the case, there are several things you will need to check. 
Are you probing the R707 hole? 


Using the USB connection from your CK3/Xtractor? If so check their 
websites for installation instructions (i.e. installing USB etc) 


Using the Serial cable, double check this is connected properly. 


Is the tray half in? You can check the User Guide on how to do this. 


Without the tray half in, you will get this error. 
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When Jungleflasher tells you to power drive with half open tray cycle 
power then — (even if you set it before you started!) 


Is the Probe/Spear connected properly, have the correct lights? Double 
check these connections. 


Using a home-made? Well unfortunately we can’t troubleshoot this for 
you, if you choose the home-made method it’s your responsibility. 


Never rule out the possibility of one of the cables being faulty. If you 
have tried all of the other checks, then try using alternative cables. 


My Maximus power adapter doesn’t eject 


This is a common one and deceives every user of the kit. You must keep 
eject pushed in for the drive to eject. Letting go will close the tray back 
over. 


| don’t know what SATA Chipset I have 


Download this program CPU-Z HERE and install it. Once installed, run the 
application, click on the Mainboard Tab. Your SATA Chipset is listed under 
Chipset. 


I got an x/y when reading/writing/verifying my drive. 
One, or a couple of instances is fine, JungleFlasher retries and as long as 


you have the 16 dots and Write Verified OK! It’s fine. 


It fails during read / write. 


It has been discovered that some CD/DVD-ROMS in your PC can cause 
issues with Jungleflasher when using onboard SATA. Disable it in in Hitachi 
Tab by right-clicking on it in drive list and selecting disable 
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|_ FimwareTool 32 | DVDKey32 | MTKAlash 32 | HitachiGDR3120 | IRC Channel 


Port Properties Use Win API © Drive | 
-| i) DA [TSSTcopCDDVDW TS-L633A T003] — 
Use Port 1O Open 
~M j Drive Revision | Scan | | Query | | U Close 
Name: 32/40 € 


Remove 


ae 3 Tahin me z Sodor lit Disable drives 
RE ve © | f Enable All itachi 
Reserved: i Manual Spoof © | Samsung, 
á Auto Spoof © Benq & Liteon 
oT ee ll Pah Time | (FAT) 


or disconnect it! OR don’t be a tight wad and buy a X360USB Pro! 


I have an xxxxxxxx Drive but JungleFlasher sees it as yyyyyyyy 


This is more than likely a Spoofed Drive. This is where a manufacturer of 
one drive, is used in place of a different manufacturer’s drive. 


The Xbox 360 checks what DVD Drive is in there using the drives OSIG. If 
this doesn’t match, the console will report E66. 


To overcome this, we can change one string in the drives Firmware, making 
one drive, report as the other, this fools the Xbox 360, but has an adverse 
affect with JungleFlasher as it will also report as the “other” drive. 


Just treat it as the drive it really is, so if it is physically a Samsung, unlock it 
like a Samsung, write Samsung Firmware too it (with spoofed OSIG) 


I LiteOn Erased my LiteOn and it failed / Device Intro Failed, now JungleFlasher 
won’t detect my drive! 


Calm down, your drive isn’t bricked! JungleFlasher tries to automate as 
much of the process as possible, making it seamless. This time, sadly, it 
didn’t work. 


All you need to do is manually do the process again, power cycle the Drive, 
then send a MTK Intro to the drive. 
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JungleFlasher Will not see the Drive (No Drive Detected) as it is actually, 
now erased. 


| get “Drive Rev Undetermined... Aborting!” When trying to dump my Hitachi 


There are two main causes for this, the main one being a user trying to 
dump the drive using WinAPI but not having the correct drive selected in 
the Top Right drop down box. Try closing JungleFlasher, scanning in Device 
Manager and reopening JungleFlasher. 


The second is caused by trying to dump a v79 that hasn’t been 79unlocked 


I’ve set Mode-B but my drive won’t show in the drop down box. 


If using Windows Vista, or Windows 7, please close JungleFlasher, scan in 
Device Manager and re-open JungleFlasher, if this doesn’t help, please 
leave your drive tray Ejected, and reboot your PC with drive still powered 
and in Mode-B. If the problem persists, please feel free to join the support 
channel and seek further assistance. HERE 


If you are using PortlO option in Hitachi tab — It’s not meant to! 


My Xbox keeps turning itself off while I’m trying to flash my drive 


If you are using the Xbox to power your drive during flashing, you MUST 
have the AV cable plugged into the Xbox (other end does NOT need to be 
connected to TV), otherwise it will power down after a few minutes 
(disaster if you are flashing a Hitachi). The HDMI cable can be used instead 
but it MUST BE connected to the TV! 


It keeps saying serial data missing? OMG what do I do? 

There is the option to rebuild the serial data from the serial numbers on the 
LiteOn case, laser and PCB. You can proceed and fill this data in IF YOU 
WISH! Go HERE for instructions on how. But — remember if the data is 

missing from the drive, do you really want to add it now? If it’s a brand new 

drive that’s not been touched before then it may be advisable to leave it! 
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I am trying to insert the unlock79 CD but I press twice to close and it opens 
again! 
This is fairly common, in mode B some drives take 3 presses of eject button 
instead of 2 to get the drive to stay closed! 


Every time I connect my drive to my VIA card my PC slows down or freezes 


Try reading the tutorial............. ! Remove your drivers for the card! 


Instructions for how to do it properly are HERE. OR in the less likely event 
that you have already correctly removed the drivers from the card and it 
still freezes — try moving your card into another PCI slot! (You may be 
required to reinstall drivers then remove using same method as before) 


| just flashed my LiteOn — placed in a game and it doesn’t work — OMG! 


Before you panic — try ejecting then closing, and then reboot the console! 
It’s possible the tray wasn’t fully closed when the console booted and 0800 
mode was activated (ix 1.6-1.61 only) — causing an error! 


In what sequence should | switch things on/connect things? 


Generally (apart from the occasional stubborn Hitachi drive) you should 
boot the pc, then connect the SATA, then power on the drive (by which 
ever method you’re using, Xbox or kit!) then open JungleFlasher. 


My VIA 6421 Raid Controller is showing up as a VIA 3249 controller? 


You installed the wrong drivers for the card! Go to HERE download the 
correct drivers install those — the drive will now show as VIA 6421 (now 
reboot) — Now return to HERE and remove them as previously instructed! 


I didn’t save my OFW, I lost my key — what can I do? 


Do not fear — Jungleflasher updates its key database on every dump carried 
out, box in firmwaretool 32 tab. Select Open Key d/b. 
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| FimwareTool 32 | DVDKey 32 | MTK Fash 32_|_HitachiGDR3120_| IRC Channel 
| 


Source Open KeyDb 
Vendor Model Rev Firmware Type DVD Key @ 
OSIG: | Open Source 


Firrmarara 


During spoofing the firmware — I got “No Calibration data in source”? 


With the release of Jungleflasher 1.70, a section of data is now copied over 
starting from hex address 3C000 this data has been talked about as 
“calibration data” At the time of writing the data is considered to be 

manufacturing test data and is unused by the drive, but for completeness is 

now copied over to your iXtreme firmware. This is shown in the running log 
at time of spoofing the firmware like: 


Spoofing Target 

DVD Key copied to target 

Inquiry string copied to Target 

Identify string copied to Target 

Serial data copied from Source to Target 
Calibration data copied from Source to Target 


A full dump of your VIRGIN drive (not one that has been returned with 
other stock firmware) is the ONLY WAY to get the ORIGINAL DATA from 
your drive into the iXtreme LT firmware. 


So IF your drive has been flashed before please IGNORE the statement that 


No Calibration data in source 
appears: 


As there is NOTHING you can do about it — it has been lost forever! 


I’ve dumped the OFW using MRA Hack and get “Parse Failed” on loading 
firmware 


There is a good chance you clicked “read” whilst the resistor is selected to 
GND (or in case of LT Switch — switch is in R/W position). After you have 
vendor mode put switch back to 3.3v (or “normal” — LT Switch) BEFORE 

pressing READ! 
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I’ve been banned from the JungleFlasher support channel wtf? 


You have obviously been bashing noobs, talking piracy or generally being 
obnoxious — the support channel doesn’t tolerate that sort of thing! Start 
groveling and change your ways. 


CLICK HERE TO RETURN 
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Additional Info for running JungleFlasher in VISTA/WIN 7 x64 


In VISTA and Win 7 it is a requirement that every driver must be signed. Because 
PortlO driver is NOT signed — it becomes necessary to work-around the Driver 
Signature Enforcement 
There are 2 ways to do this. 

One is simple but is required to be done every time you boot the pc and wish to 
use the driver! 

The other, is a way of setting test mode to be selected upon every boot of the 
system 


Easy Way of Disabling Driver Signature Enforcement 


1) On boot up press F8 to get to the extended boot options screen 
2) Choose "Disable Driver Signature Enforcement" 
3) To start JungleFlasher right click on it in Windows Explorer and choose 
“oroperties”/compatibility — tick "Run as administrator" > click “ok”. 
(This will enable JungleFlasher to run as Administrator every time you run it) 
4) If a "Program Compatibility Assistant" warning message is displayed whilst you 
run JungleFlasher, you can simply ignore this by pressing the "Close" button 


Recommended Way of Disabling Driver Signature Enforcement 


PortlO64.sys file is no longer included in Jungleflasher download — if you wish to sign it — 
download it here 


1) Disable User Account Control (UAC) In WIN 7 
- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" 
>"User Accounts" 
- click on "Change User Account Control settings" 
- set the slider bar to the lowest value (Never notify) > click "OK" 
Disable User Account Control (UAC) In Vista 
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- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" 
>"User Accounts" 
Click “Turn User Account Control on or off” > click continue, untick the box, click 
OK 


2) Sign the portio.sys driver 
- download the "Driver Signature Enforcement Overrider" (DSEO) from 
http://www.ngohq.com/home.php?page=dseo 

- start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter 

the path to the used driver (portio32.sys or portio64.sys) > "OK" > "OK" 

3) Disable Driver Signature Enforcement 
- start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK" 
4) Restart the computer 


CLICK HERE TO RETURN 
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JungleFlasher v0.1.87 beta 

Thanks to: 
c4eva & Team Jungle 
Team - Xecuter 
Schtrom (Legend in his own right) 
Seacrest (Openkey) 
Team Modfreakz (for all you have contributed!) 

MRA (©) 

Geremia (Kamikaze Unlock) 

Maximus (for Scorpion2 - to reverse and improve) 
Giampy (LiteOn Barcode Rebuilder) 
& 


The Testers (well, obviously for testing) 


CLICK HERE TO RETURN TO STARTING POINT 
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